Montana K-12 Email Security Intelligence:
DNS Authentication Profiling of 489 School District LEAs

Lokentra Research Team

Lokentra U.S. Email Security Index (ESI) — State Intelligence Series

April 22, 2026

research@monitorworkspace.com • monitorworkspace.com/scorecard

Abstract

We present DNS email security profiling for 489 K-12 LEAs in Montana, of which 260 have active domains (53.2% coverage). Domains were scored on the Lokentra 100-point Email Security Index (ESI) rubric (SPF 30 pts + DKIM 30 pts + DMARC 40 pts). Montana K-12 districts achieve an average ESI score of 43.9/100, with 25.8% earning Grade A or B (strong posture) and 40.8% receiving Grade F (minimal authentication). Only 46.2% have any DMARC record, and just 26.2% have DMARC at an enforcement level (quarantine or reject) — leaving 53.8% of districts fully vulnerable to email domain spoofing. This report provides entity-level data for all 260 scored domains including provider classification, authentication status, and ESI score, sourced from NCES CCD 2024-2025 and live DNS resolution conducted April 22, 2026.

Keywords: Montana, K-12 email security, DMARC, SPF, school district cybersecurity, DNS authentication, Google Workspace, education technology

1. Dataset Overview

Table 1. Montana K-12 Dataset Summary
Metric	Value
Total K-12 LEAs in state	489
Regular school districts	404
Charter LEAs	0
Other LEA types (state-operated, regional, etc.)	85
LEAs with active internet domain	260 (53.2%)
Domains DNS-profiled	260
Data freshness (NCES CCD)	2024-2025 school year
DNS scan date	April 22, 2026

2. The Human Impact: Populations at Risk

To estimate human exposure, NCES national averages are applied to CCD 2024-2025 operational school counts: 381 students per school, 51 staff per school, and 2 parents or guardians per student. Montana K-12 districts collectively operate approximately 842 schools.

Table 2. Estimated Population Exposure from K-12 Email Security Gaps — Montana
Population	Total in Dataset	At Risk (No DMARC, 53.8%)	Critically Exposed (Grade F, 40.8%)
Students	320,802	172,591	130,887
Parents and guardians	641,604	345,182	261,774
Staff and educators	42,942	23,102	17,520
Total people	1,005,348	540,877	410,181

Estimates based on NCES national averages. Individual district enrollment data can be linked via NCES LEAID for precise counts.

3. Authentication Findings

3.1 Protocol Adoption

Table 3. Email Authentication Protocol Adoption — Montana K-12
Protocol	Montana	National K-12 (ESI)	vs. National
SPF (any configuration)	69.6%	79.7%	-10.1pp
DKIM (key published)	46.2%	59.6%	-13.4pp
DMARC (any policy)	46.2%	55.5%	-9.3pp
DMARC at enforcement (quarantine/reject)	26.2%	~21.0%	+5.2pp
DMARC at reject (full enforcement)	16.2%	~12.2%	+4.0pp
No MX records (not receiving email)	17.7%	~10.0%	+7.7pp

3.2 ESI Grade Distribution

Table 4. ESI Score Grade Distribution — Montana K-12
Grade	Score	Districts	Share	Interpretation
A	90–100	45	17.3%	Full enforcement
B	70–89	22	8.5%	Strong posture
C	50–69	55	21.2%	Partial protection
D	30–49	32	12.3%	Weak configuration
F	0–29	106	40.8%	Minimal/no authentication
Average score		43.9 / 100

3.3 Email Provider Distribution

Table 5. Email Provider Distribution — Montana K-12 (top providers)
Provider	Districts	Share
Google Workspace	145	55.8%
Microsoft 365	29	11.2%
Sophos	6	2.3%
GoDaddy	5	1.9%
Barracuda	3	1.2%
Mimecast	1	0.4%

4. District-Level Data

4.1 Top Performing Districts (Best ESI Scores)

Table 6. Top 15 Montana K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Score	Grade
Silver Bow	`bsb.mt.gov`	Silver Bow County	Barracuda	✓	✓	reject	100	A
Billings H S	`billingsschools.org`	Yellowstone County	Google Workspace	✓	✓	reject	100	A
DeSmet Elem	`desmetschool.org`	Missoula County	Google Workspace	✓	✓	reject	100	A
Great Falls H S	`gfps.k12.mt.us`	Cascade County	Microsoft 365	✓	✓	reject	100	A
Plentywood K-12 Schools	`plentywood.k12.mt.us`	Sheridan County	Google Workspace	✓	✓	reject	100	A
Valier H S	`valier.k12.mt.us`	Pondera County	Google Workspace	✓	✓	reject	100	A
Woodman Elem	`woodmanschool.org`	Missoula County	Google Workspace	✓	✓	reject	100	A
Missoula	`co.missoula.mt.us`	Missoula County	—	✓	✓	reject	98	A
Powder River Co Dist H S	`broadus.net`	Powder River County	Google Workspace	✓	✓	reject	95	A
Noxon H S	`noxonschools.com`	Sanders County	Google Workspace	✓	✓	reject	95	A
Chester-Joplin-Inverness HS	`cji.k12.mt.us`	Liberty County	Google Workspace	✓	✓	reject	95	A
Alberton K-12 Schools	`alberton.k12.mt.us`	Mineral County	Google Workspace	✓	✓	reject	95	A
Arlee H S	`arleeschools.org`	Lake County	Google Workspace	✓	✓	reject	95	A
Boulder Elem	`bgs.k12.mt.us`	Jefferson County	Google Workspace	✓	✓	reject	95	A
Brockton H S	`brockton.k12.mt.us`	Roosevelt County	Google Workspace	✓	✓	reject	95	A

4.2 Districts Most in Need of Improvement (Lowest ESI Scores)

Table 7. Bottom 15 Montana K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Grade
Ashland Elem	`ashlandpublicschool.com`	Rosebud County	Google Workspace	✗	✗	—	F
Custer	`custer.mt.schoolwebpages.com`	Custer County	—	✗	✗	—	F
Prairie View Coop	`pvssmt.org`	Dawson County	Google Workspace	✗	✗	—	F
Swan Lake-Salmon Elem	`lakecounty-mt.org`	Lake County	—	✗	✗	—	F
Madison	`madison.mt.gov`	Madison County	Microsoft 365	✗	✗	—	F
Ravalli	`ravallicounty.mt.gov`	Ravalli County	—	✗	✗	—	F
Stillwater	`stillwater.mt.gov`	Stillwater County	Microsoft 365	✗	✗	—	F
Liberty	`co.liberty.mt.us`	Liberty County	—	✗	✗	—	F
Pine Creek Elem	`sites.google.com`	Park County	—	✗	✗	—	F
Lame Deer Elem	`lamedeerschools.org`	Rosebud County	—	✗	✗	—	F
Lincoln	`lincolncountymt.us`	Lincoln County	—	✗	✗	—	F
Sweet Grass	`co.sweetgrass.mt.us`	Sweet Grass County	—	✗	✗	—	F
Intermtn Childrens Home	`intermountainresidential.org`	Lewis and Clark County	—	✗	✗	—	F
Dutton/Brady K-12 Schools	`dbps.k12.mt.us`	Teton County	—	✗	✗	—	F
Absarokee H S	`hgunderson6.wixsite.com`	Stillwater County	—	✗	✗	—	F

4.3 County-Level Summary (Top 10 Counties by District Count)

Table 8. Montana County Distribution
County	Districts	Website Coverage
Flathead County	25	88.0%
Gallatin County	23	82.6%
Yellowstone County	23	87.0%
Lewis and Clark County	16	62.5%
Fergus County	16	68.8%
Missoula County	16	87.5%
Cascade County	15	93.3%
Stillwater County	15	73.3%
Lake County	14	92.9%
Roosevelt County	14	92.9%

5. Policy Implications

These findings identify specific, actionable gaps in Montana's K-12 email security posture. The 53.8% DMARC gap represents districts that can be impersonated by any sender, enabling phishing campaigns targeting parents, students, and educators with no authentication failure. Key observations:

Immediate risk: 106 districts (40.8%) have Grade F scores, indicating minimal or no email authentication. These represent the highest-priority remediation targets.
Mid-tier stagnation: 55 districts (21.2%) are in the C range — typically have SPF but no DMARC or weak DMARC (p=none). Upgrading to p=quarantine would move them to B without infrastructure changes.
Provider leverage: Google Workspace (used by 55.8% of scored districts) provides automated SPF/DKIM configuration. Districts on Google Workspace with Grade F scores have misconfigured or missing DMARC — a free and simple fix.

6. Data Availability

The full Montana K-12 dataset — 489 entities with NCES CCD enrichment (phone, address, grade span, school count, LEAID) and DNS authentication profiles — is available as part of the Lokentra ESI State Pack.

Table 9. Licensing Tiers
Tier	Scope	Suggested Use
State Pack: Montana	All 489 K-12 LEAs, full DNS profile + CCD enrichment	Regional studies, state policy, outreach
K-12 National	All 50 states, 20,021+ K-12 LEAs	National K-12 cybersecurity research
Full Registry	801,359+ entities across all sectors	Comprehensive multi-sector research
API + Updates	Quarterly re-scan, REST API	Longitudinal studies, live dashboards

Contact: research@monitorworkspace.com — Free demo at monitorworkspace.com/scorecard

Citation: Lokentra Research Team (2026). Montana K-12 Email Security Intelligence: DNS Authentication Profiling of 489 School District LEAs. Lokentra U.S. Email Security Index (ESI) — State Intelligence Series. https://lokentra-site.web.app/research/states/mt-k12-paper.html

Data sources: NCES Common Core of Data (CCD) 2024-2025; DNS records resolved via Google Public DNS (8.8.8.8) and Cloudflare (1.1.1.1). All entity data derived from publicly accessible government registries.

National baseline figures from Lokentra U.S. Education Sector Email Security Intelligence Dataset (March 2026). See education-dataset-paper.html for full methodology.

Montana K-12 Email Security Intelligence:DNS Authentication Profiling of 489 School District LEAs