New York K-12 Email Security Intelligence:
DNS Authentication Profiling of 1111 School District LEAs

Lokentra Research Team

Lokentra U.S. Email Security Index (ESI) — State Intelligence Series

April 22, 2026

research@monitorworkspace.com • monitorworkspace.com/scorecard

Abstract

We present DNS email security profiling for 1111 K-12 LEAs in New York, of which 942 have active domains (84.8% coverage). Domains were scored on the Lokentra 100-point Email Security Index (ESI) rubric (SPF 30 pts + DKIM 30 pts + DMARC 40 pts). New York K-12 districts achieve an average ESI score of 54.4/100, with 36.6% earning Grade A or B (strong posture) and 20.6% receiving Grade F (minimal authentication). Only 68.5% have any DMARC record, and just 30.3% have DMARC at an enforcement level (quarantine or reject) — leaving 31.5% of districts fully vulnerable to email domain spoofing. This report provides entity-level data for all 942 scored domains including provider classification, authentication status, and ESI score, sourced from NCES CCD 2024-2025 and live DNS resolution conducted April 22, 2026.

Keywords: New York, K-12 email security, DMARC, SPF, school district cybersecurity, DNS authentication, Google Workspace, education technology

1. Dataset Overview

Table 1. New York K-12 Dataset Summary
Metric	Value
Total K-12 LEAs in state	1111
Regular school districts	724
Charter LEAs	344
Other LEA types (state-operated, regional, etc.)	43
LEAs with active internet domain	942 (84.8%)
Domains DNS-profiled	942
Data freshness (NCES CCD)	2024-2025 school year
DNS scan date	April 22, 2026

2. The Human Impact: Populations at Risk

To estimate human exposure, NCES national averages are applied to CCD 2024-2025 operational school counts: 381 students per school, 51 staff per school, and 2 parents or guardians per student. New York K-12 districts collectively operate approximately 4,796 schools.

Table 2. Estimated Population Exposure from K-12 Email Security Gaps — New York
Population	Total in Dataset	At Risk (No DMARC, 31.5%)	Critically Exposed (Grade F, 20.6%)
Students	1,827,276	575,591	376,418
Parents and guardians	3,654,552	1,151,183	752,837
Staff and educators	244,596	77,047	50,386
Total people	5,726,424	1,803,823	1,179,643

Estimates based on NCES national averages. Individual district enrollment data can be linked via NCES LEAID for precise counts.

3. Authentication Findings

3.1 Protocol Adoption

Table 3. Email Authentication Protocol Adoption — New York K-12
Protocol	New York	National K-12 (ESI)	vs. National
SPF (any configuration)	81.5%	79.7%	+1.8pp
DKIM (key published)	59.3%	59.6%	-0.3pp
DMARC (any policy)	68.5%	55.5%	+13.0pp
DMARC at enforcement (quarantine/reject)	30.3%	~21.0%	+9.3pp
DMARC at reject (full enforcement)	9.4%	~12.2%	-2.8pp
No MX records (not receiving email)	11.0%	~10.0%	+1.0pp

3.2 ESI Grade Distribution

Table 4. ESI Score Grade Distribution — New York K-12
Grade	Score	Districts	Share	Interpretation
A	90–100	166	17.6%	Full enforcement
B	70–89	179	19.0%	Strong posture
C	50–69	233	24.7%	Partial protection
D	30–49	170	18.0%	Weak configuration
F	0–29	194	20.6%	Minimal/no authentication
Average score		54.4 / 100

3.3 Email Provider Distribution

Table 5. Email Provider Distribution — New York K-12 (top providers)
Provider	Districts	Share
Google Workspace	456	48.4%
Microsoft 365	149	15.8%
Barracuda	66	7.0%
Mimecast	61	6.5%
Proofpoint	4	0.4%
Sophos	2	0.2%

4. District-Level Data

4.1 Top Performing Districts (Best ESI Scores)

Table 6. Top 15 New York K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Score	Grade
PAVE ACADEMY CHARTER SCHOOL	`paveschools.org`	Kings County	Google Workspace	✓	✓	reject	100	A
DISCOVERY CHARTER SCHOOL	`rochesterdiscovery.com`	Monroe County	Microsoft 365	✓	✓	reject	100	A
NEW DAWN CHARTER HIGH SCHOOL	`ndchsbrooklyn.org`	Kings County	Microsoft 365	✓	✓	reject	100	A
BATH CENTRAL SCHOOL DISTRICT	`bathcsd.org`	Steuben County	—	✓	✓	reject	100	A
BETHPAGE UNION FREE SCHOOL DISTRICT	`bethpagecommunity.com`	Nassau County	—	✓	✓	reject	100	A
BRENTWOOD UNION FREE SCHOOL DISTRICT	`brentwood.k12.ny.us`	Suffolk County	—	✓	✓	reject	100	A
BRIGHTON CENTRAL SCHOOL DISTRICT	`bcsd.org`	Monroe County	Microsoft 365	✓	✓	reject	100	A
CANDOR CENTRAL SCHOOL DISTRICT	`candorcs.org`	Tioga County	Mimecast	✓	✓	reject	100	A
DOVER UNION FREE SCHOOL DISTRICT	`doverschools.org`	Dutchess County	Barracuda	✓	✓	reject	100	A
FREEPORT UNION FREE SCHOOL DISTRICT	`freeportschools.org`	Nassau County	Microsoft 365	✓	✓	reject	100	A
GREAT NECK UNION FREE SCHOOL DISTRICT	`greatneck.k12.ny.us`	Nassau County	Google Workspace	✓	✓	reject	100	A
HAMPTON BAYS UNION FREE SCHOOL DISTRICT	`hbschools.us`	Suffolk County	Barracuda	✓	✓	reject	100	A
HARTFORD CENTRAL SCHOOL DISTRICT	`hartfordcsd.org`	Washington County	Google Workspace	✓	✓	reject	100	A
HEMPSTEAD UNION FREE SCHOOL DISTRICT	`hempsteadschools.org`	Nassau County	Microsoft 365	✓	✓	reject	100	A
ISLAND TREES UNION FREE SCHOOL DISTRICT	`islandtrees.org`	Nassau County	Microsoft 365	✓	✓	reject	100	A

4.2 Districts Most in Need of Improvement (Lowest ESI Scores)

Table 7. Bottom 15 New York K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Grade
CHERRY VALLEY-SPRINGFIELD CENTRAL SCHOOL DISTRICT	`cvscs.org`	Otsego County	—	✗	✗	—	F
KING CENTER CHARTER SCHOOL	`kccs.org`	Erie County	Google Workspace	✗	✗	—	F
HARBOR SCIENCE AND ARTS CHARTER SCHOOL	`hsacs.org`	New York County	Google Workspace	✗	✗	—	F
ICAHN CHARTER SCHOOL 1	`icahncharterschool1.org`	Bronx County	—	✗	✗	—	F
SISULU-WALKER CHARTER SCHOOL OF HARLEM	`sisuluwalker.org`	New York County	Google Workspace	✗	✗	—	F
RIVERHEAD CHARTER SCHOOL	`riverheadcharterschool.org`	Suffolk County	—	✗	✗	—	F
GLOBAL CONCEPTS CHARTER SCHOOL	`globalconceptscs.org`	Erie County	—	✗	✗	—	F
SYRACUSE ACADEMY OF SCIENCE CHARTER SCHOOL	`sascs.org`	Onondaga County	Google Workspace	✗	✗	—	F
EXCELLENCE BOYS CHARTER SCHOOL OF BEDFORD STUYVESANT	`excellenceboys.uncommonschools.org`	Kings County	—	✗	✗	—	F
BROOKLYN EXCELSIOR CHARTER SCHOOL	`brooklynexcelsiorcharterschool.org`	Kings County	—	✗	✗	—	F
GIRLS PREPARATORY CHARTER SCHOOL OF NEW YORK	`girlspreples.org`	New York County	—	✗	✗	—	F
WILLIAMSBURG COLLEGIATE CHARTER SCHOOL	`nyc.uncommonschools.org`	Kings County	—	✗	✗	—	F
CHARTER SCHOOL OF EDUCATIONAL EXCELLENCE	`charterschoolofeducationalexcellence.org`	Westchester County	—	✗	✗	—	F
LEADERSHIP PREPARATORY BEDFORD STUYVESANT CHARTER SCHOOL	`leadershipprepbedstuy.uncommonschools.org`	Kings County	—	✗	✗	—	F
ICAHN CHARTER SCHOOL 2	`icahncharterschool2.org`	Bronx County	—	✗	✗	—	F

4.3 County-Level Summary (Top 10 Counties by District Count)

Table 8. New York County Distribution
County	Districts	Website Coverage
Kings County	104	83.7%
Bronx County	99	91.9%
Suffolk County	73	100.0%
New York County	65	86.2%
Nassau County	61	100.0%
Erie County	53	96.2%
Westchester County	51	100.0%
Monroe County	37	97.3%
Queens County	34	79.4%
Onondaga County	23	100.0%

5. Policy Implications

These findings identify specific, actionable gaps in New York's K-12 email security posture. The 31.5% DMARC gap represents districts that can be impersonated by any sender, enabling phishing campaigns targeting parents, students, and educators with no authentication failure. Key observations:

Immediate risk: 194 districts (20.6%) have Grade F scores, indicating minimal or no email authentication. These represent the highest-priority remediation targets.
Mid-tier stagnation: 233 districts (24.7%) are in the C range — typically have SPF but no DMARC or weak DMARC (p=none). Upgrading to p=quarantine would move them to B without infrastructure changes.
Provider leverage: Google Workspace (used by 48.4% of scored districts) provides automated SPF/DKIM configuration. Districts on Google Workspace with Grade F scores have misconfigured or missing DMARC — a free and simple fix.

6. Data Availability

The full New York K-12 dataset — 1111 entities with NCES CCD enrichment (phone, address, grade span, school count, LEAID) and DNS authentication profiles — is available as part of the Lokentra ESI State Pack.

Table 9. Licensing Tiers
Tier	Scope	Suggested Use
State Pack: New York	All 1111 K-12 LEAs, full DNS profile + CCD enrichment	Regional studies, state policy, outreach
K-12 National	All 50 states, 20,021+ K-12 LEAs	National K-12 cybersecurity research
Full Registry	801,359+ entities across all sectors	Comprehensive multi-sector research
API + Updates	Quarterly re-scan, REST API	Longitudinal studies, live dashboards

Contact: research@monitorworkspace.com — Free demo at monitorworkspace.com/scorecard

Citation: Lokentra Research Team (2026). New York K-12 Email Security Intelligence: DNS Authentication Profiling of 1111 School District LEAs. Lokentra U.S. Email Security Index (ESI) — State Intelligence Series. https://lokentra-site.web.app/research/states/ny-k12-paper.html

Data sources: NCES Common Core of Data (CCD) 2024-2025; DNS records resolved via Google Public DNS (8.8.8.8) and Cloudflare (1.1.1.1). All entity data derived from publicly accessible government registries.

National baseline figures from Lokentra U.S. Education Sector Email Security Intelligence Dataset (March 2026). See education-dataset-paper.html for full methodology.

New York K-12 Email Security Intelligence:DNS Authentication Profiling of 1111 School District LEAs