We present DNS email security profiling for 148 K-12 LEAs in Tennessee, of which 136 have active domains (91.9% coverage). Domains were scored on the Lokentra 100-point Email Security Index (ESI) rubric (SPF 30 pts + DKIM 30 pts + DMARC 40 pts). Tennessee K-12 districts achieve an average ESI score of 45.1/100, with 28.7% earning Grade A or B (strong posture) and 36.8% receiving Grade F (minimal authentication). Only 40.4% have any DMARC record, and just 25.7% have DMARC at an enforcement level (quarantine or reject) — leaving 59.6% of districts fully vulnerable to email domain spoofing. This report provides entity-level data for all 136 scored domains including provider classification, authentication status, and ESI score, sourced from NCES CCD 2024-2025 and live DNS resolution conducted April 22, 2026.
| Metric | Value |
|---|---|
| Total K-12 LEAs in state | 148 |
| Regular school districts | 140 |
| Charter LEAs | 1 |
| Other LEA types (state-operated, regional, etc.) | 7 |
| LEAs with active internet domain | 136 (91.9%) |
| Domains DNS-profiled | 136 |
| Data freshness (NCES CCD) | 2024-2025 school year |
| DNS scan date | April 22, 2026 |
To estimate human exposure, NCES national averages are applied to CCD 2024-2025 operational school counts: 381 students per school, 51 staff per school, and 2 parents or guardians per student. Tennessee K-12 districts collectively operate approximately 1,910 schools.
| Population | Total in Dataset | At Risk (No DMARC, 59.6%) | Critically Exposed (Grade F, 36.8%) |
|---|---|---|---|
| Students | 727,710 | 433,715 | 267,797 |
| Parents and guardians | 1,455,420 | 867,430 | 535,594 |
| Staff and educators | 97,410 | 58,056 | 35,846 |
| Total people | 2,280,540 | 1,359,201 | 839,238 |
Estimates based on NCES national averages. Individual district enrollment data can be linked via NCES LEAID for precise counts.
| Protocol | Tennessee | National K-12 (ESI) | vs. National |
|---|---|---|---|
| SPF (any configuration) | 72.8% | 79.7% | -6.9pp |
| DKIM (key published) | 50.7% | 59.6% | -8.9pp |
| DMARC (any policy) | 40.4% | 55.5% | -15.1pp |
| DMARC at enforcement (quarantine/reject) | 25.7% | ~21.0% | +4.7pp |
| DMARC at reject (full enforcement) | 9.6% | ~12.2% | -2.6pp |
| No MX records (not receiving email) | 21.3% | ~10.0% | +11.3pp |
| Grade | Score | Districts | Share | Interpretation |
|---|---|---|---|---|
| A | 90–100 | 21 | 15.4% | Full enforcement |
| B | 70–89 | 18 | 13.2% | Strong posture |
| C | 50–69 | 29 | 21.3% | Partial protection |
| D | 30–49 | 18 | 13.2% | Weak configuration |
| F | 0–29 | 50 | 36.8% | Minimal/no authentication |
| Average score | 45.1 / 100 | |||
| Provider | Districts | Share |
|---|---|---|
| Google Workspace | 58 | 42.6% |
| Microsoft 365 | 33 | 24.3% |
| Barracuda | 5 | 3.7% |
| Proofpoint | 3 | 2.2% |
| GoDaddy | 2 | 1.5% |
| District | Domain | County | Provider | SPF | DKIM | DMARC Policy | Score | Grade |
|---|---|---|---|---|---|---|---|---|
colliervilleschools.org |
Shelby County | Microsoft 365 | ✓ | ✓ | reject | 100 | A | |
acsk-12.org |
Shelby County | Microsoft 365 | ✓ | ✓ | reject | 100 | A | |
cmcss.net |
Montgomery County | Proofpoint | ✓ | ✓ | reject | 100 | A | |
polk-schools.com |
Polk County | Google Workspace | ✓ | ✓ | reject | 100 | A | |
tn.gov |
Davidson County | Proofpoint | ✓ | ✓ | reject | 95 | A | |
lakelandk12.org |
Shelby County | Google Workspace | ✓ | ✓ | reject | 95 | A | |
dekalbschools.net |
DeKalb County | Google Workspace | ✓ | ✓ | reject | 95 | A | |
k12k.com |
Sullivan County | Barracuda | ✓ | ✓ | reject | 95 | A | |
lssd.org |
Wilson County | Google Workspace | ✓ | ✓ | reject | 95 | A | |
pickettk12.net |
Pickett County | Google Workspace | ✓ | ✓ | reject | 95 | A | |
sevier.org |
Sevier County | Google Workspace | ✓ | ✓ | reject | 95 | A | |
wcssd.org |
Carroll County | Microsoft 365 | ✓ | ✓ | reject | 95 | A | |
gcschools.net |
Greene County | Barracuda | ✓ | ✓ | reject | 93 | A | |
bartlettschools.org |
Shelby County | Microsoft 365 | ✓ | ✓ | quarantine | 90 | A | |
lewisk12.org |
Lewis County | Microsoft 365 | ✓ | ✓ | quarantine | 90 | A |
| District | Domain | County | Provider | SPF | DKIM | DMARC Policy | Score | Grade |
|---|---|---|---|---|---|---|---|---|
bedfordk12tn.com |
Bedford County | — | ✗ | ✗ | — | 0 | F | |
bledsoe.k12.tn.us |
Bledsoe County | — | ✗ | ✗ | — | 0 | F | |
campbell.k12.tn.us |
Campbell County | — | ✗ | ✗ | — | 0 | F | |
bcvs.bradleyschools.org |
Bradley County | — | ✗ | ✗ | — | 0 | F | |
claibornecountyschools.com |
Claiborne County | Google Workspace | ✗ | ✗ | — | 0 | F | |
carterk12.org |
Carter County | — | ✗ | ✗ | — | 0 | F | |
ccetc.org |
Crockett County | — | ✗ | ✗ | — | 0 | F | |
dicksoncountyschools.org |
Dickson County | — | ✗ | ✗ | — | 0 | F | |
fentress.k12tn.net |
Fentress County | — | ✗ | ✗ | — | 0 | F | |
giles-lea.giles.k12.tn.us |
Giles County | — | ✗ | ✗ | — | 0 | F | |
grundycoschools.com |
Grundy County | — | ✗ | ✗ | — | 0 | F | |
hancockcountyschools.com |
Hancock County | Google Workspace | ✗ | ✗ | — | 0 | F | |
hardin.k12.tn.us |
Hardin County | — | ✗ | ✗ | — | 0 | F | |
haywoodschools.com |
Haywood County | GoDaddy | ✗ | ✗ | — | 0 | F | |
houston.k12.tn.us |
Houston County | — | ✗ | ✗ | — | 0 | F |
| County | Districts | Website Coverage |
|---|---|---|
| Shelby County | 7 | 100.0% |
| Carroll County | 6 | 66.7% |
| Gibson County | 5 | 80.0% |
| Davidson County | 4 | 100.0% |
| Coffee County | 4 | 100.0% |
| Crockett County | 3 | 66.7% |
| Blount County | 3 | 100.0% |
| Anderson County | 3 | 100.0% |
| McMinn County | 3 | 100.0% |
| Sullivan County | 3 | 100.0% |
These findings identify specific, actionable gaps in Tennessee's K-12 email security posture. The 59.6% DMARC gap represents districts that can be impersonated by any sender, enabling phishing campaigns targeting parents, students, and educators with no authentication failure. Key observations:
p=none). Upgrading to p=quarantine would move them to B without infrastructure changes.The full Tennessee K-12 dataset — 148 entities with NCES CCD enrichment (phone, address, grade span, school count, LEAID) and DNS authentication profiles — is available as part of the Lokentra ESI State Pack.
| Tier | Scope | Suggested Use |
|---|---|---|
| State Pack: Tennessee | All 148 K-12 LEAs, full DNS profile + CCD enrichment | Regional studies, state policy, outreach |
| K-12 National | All 50 states, 20,021+ K-12 LEAs | National K-12 cybersecurity research |
| Full Registry | 801,359+ entities across all sectors | Comprehensive multi-sector research |
| API + Updates | Quarterly re-scan, REST API | Longitudinal studies, live dashboards |
Contact: research@monitorworkspace.com — Free demo at monitorworkspace.com/scorecard
Citation: Lokentra Research Team (2026). Tennessee K-12 Email Security Intelligence: DNS Authentication Profiling of 148 School District LEAs. Lokentra U.S. Email Security Index (ESI) — State Intelligence Series. https://lokentra-site.web.app/research/states/tn-k12-paper.html
Data sources: NCES Common Core of Data (CCD) 2024-2025; DNS records resolved via Google Public DNS (8.8.8.8) and Cloudflare (1.1.1.1). All entity data derived from publicly accessible government registries.
National baseline figures from Lokentra U.S. Education Sector Email Security Intelligence Dataset (March 2026). See education-dataset-paper.html for full methodology.