Vermont K-12 Email Security Intelligence:
DNS Authentication Profiling of 183 School District LEAs

Lokentra Research Team

Lokentra U.S. Email Security Index (ESI) — State Intelligence Series

April 22, 2026

research@monitorworkspace.com • monitorworkspace.com/scorecard

Abstract

We present DNS email security profiling for 183 K-12 LEAs in Vermont, of which 70 have active domains (38.3% coverage). Domains were scored on the Lokentra 100-point Email Security Index (ESI) rubric (SPF 30 pts + DKIM 30 pts + DMARC 40 pts). Vermont K-12 districts achieve an average ESI score of 37.0/100, with 20.0% earning Grade A or B (strong posture) and 45.7% receiving Grade F (minimal authentication). Only 35.7% have any DMARC record, and just 17.1% have DMARC at an enforcement level (quarantine or reject) — leaving 64.3% of districts fully vulnerable to email domain spoofing. This report provides entity-level data for all 70 scored domains including provider classification, authentication status, and ESI score, sourced from NCES CCD 2024-2025 and live DNS resolution conducted April 22, 2026.

Keywords: Vermont, K-12 email security, DMARC, SPF, school district cybersecurity, DNS authentication, Google Workspace, education technology

1. Dataset Overview

Table 1. Vermont K-12 Dataset Summary
Metric	Value
Total K-12 LEAs in state	183
Regular school districts	127
Charter LEAs	0
Other LEA types (state-operated, regional, etc.)	56
LEAs with active internet domain	70 (38.3%)
Domains DNS-profiled	70
Data freshness (NCES CCD)	2024-2025 school year
DNS scan date	April 22, 2026

2. The Human Impact: Populations at Risk

To estimate human exposure, NCES national averages are applied to CCD 2024-2025 operational school counts: 381 students per school, 51 staff per school, and 2 parents or guardians per student. Vermont K-12 districts collectively operate approximately 297 schools.

Table 2. Estimated Population Exposure from K-12 Email Security Gaps — Vermont
Population	Total in Dataset	At Risk (No DMARC, 64.3%)	Critically Exposed (Grade F, 45.7%)
Students	113,157	72,759	51,712
Parents and guardians	226,314	145,519	103,425
Staff and educators	15,147	9,739	6,922
Total people	354,618	228,019	162,060

Estimates based on NCES national averages. Individual district enrollment data can be linked via NCES LEAID for precise counts.

3. Authentication Findings

3.1 Protocol Adoption

Table 3. Email Authentication Protocol Adoption — Vermont K-12
Protocol	Vermont	National K-12 (ESI)	vs. National
SPF (any configuration)	62.9%	79.7%	-16.8pp
DKIM (key published)	42.9%	59.6%	-16.7pp
DMARC (any policy)	35.7%	55.5%	-19.8pp
DMARC at enforcement (quarantine/reject)	17.1%	~21.0%	-3.9pp
DMARC at reject (full enforcement)	4.3%	~12.2%	-7.9pp
No MX records (not receiving email)	28.6%	~10.0%	+18.6pp

3.2 ESI Grade Distribution

Table 4. ESI Score Grade Distribution — Vermont K-12
Grade	Score	Districts	Share	Interpretation
A	90–100	2	2.9%	Full enforcement
B	70–89	12	17.1%	Strong posture
C	50–69	15	21.4%	Partial protection
D	30–49	9	12.9%	Weak configuration
F	0–29	32	45.7%	Minimal/no authentication
Average score		37.0 / 100

3.3 Email Provider Distribution

Table 5. Email Provider Distribution — Vermont K-12 (top providers)
Provider	Districts	Share
Google Workspace	45	64.3%
Barracuda	2	2.9%

4. District-Level Data

4.1 Top Performing Districts (Best ESI Scores)

Table 6. Top 15 Vermont K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Score	Grade
Mill River Unified Union Supervisory District	`rssu.org`	Rutland County	Google Workspace	✓	✓	reject	95	A
Orleans Southwest Supervisory Union	`ossu.org`	Caledonia County	Google Workspace	✓	✓	reject	95	A
Essex Westford Educational Community Unified Union SD #51	`ewsd.org`	Chittenden County	Google Workspace	✓	✓	quarantine	85	B
Echo Valley Community Union School District #67	`cvsu.org`	Orange County	Google Workspace	✓	✓	quarantine	85	B
Mt. Abraham Unified School District (Supervisory)	`anesu.org`	Addison County	Google Workspace	✓	✓	quarantine	85	B
Missisquoi Valley School District (Supervisory)	`fnwsu.org`	Franklin County	Google Workspace	✓	✓	quarantine	85	B
Southwest Vermont Supervisory Union	`svsu.org`	Bennington County	Google Workspace	✓	✓	quarantine	85	B
Orleans Central Supervisory Union	`ocsu.org`	Orleans County	Google Workspace	✓	✓	quarantine	85	B
Mount Mansfield Unified Union School District (Supervisory)	`mmuusd.org`	Chittenden County	Google Workspace	✓	✓	quarantine	85	B
North Country Supervisory Union	`ncsuvt.org`	Orleans County	Google Workspace	✓	✓	quarantine	85	B
Windsor Central Supervisory Union	`wcsu.net`	Windsor County	Google Workspace	⚠	✓	quarantine	75	B
Addison Northwest Supervisory District	`anwsu.org`	Addison County	Google Workspace	✓	✓	none	70	B
Maple Run Supervisory District	`fcsuvt.org`	Franklin County	Google Workspace	✓	✓	none	70	B
Windsor Southeast Supervisory Union	`wsesu.net`	Windsor County	Google Workspace	✓	✓	none	70	B
Orange Southwest Supervisory Union	`orangesouthwest.org`	Orange County	Google Workspace	✓	✓	none	65	C

4.2 Districts Most in Need of Improvement (Lowest ESI Scores)

Table 7. Bottom 15 Vermont K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Grade
Patricia Hannaford Career Center	`hannafordcareercenter.org`	Addison County	—	✗	✗	—	F
Barre Unified Union School District #97	`bsuvt.org`	Washington County	—	✗	✗	—	F
Green Mountain Unified School District #77	`su.trsu.org`	Windsor County	—	✗	✗	—	F
Department of Corrections	`doc.state.vt.us`	Washington County	—	✗	✗	—	F
Otter Valley Unified Union School District #53	`ovuhs.rnesu.org`	Rutland County	—	✗	✗	—	F
Lamoille North Supervisory Union	`lnsu.cloudaccess.net`	Lamoille County	—	✗	✗	—	F
Quarry Valley Unified Union School District #70	`wp.grcsu.org`	Rutland County	—	✗	✗	—	F
Montpelier Roxbury Unified Union School District #71	`mrpsvt.org`	Washington County	—	✗	✗	—	F
Addison Central Supervisory District	`acsu.k12.vt.us`	Addison County	Google Workspace	✗	✗	—	F
Windham Southwest Supervisory Union	`windhamsw.k12.vt.us`	Windham County	—	✗	✗	—	F
Windham Southeast Supervisory Union	`wssu.k12.vt.us`	Windham County	Barracuda	✗	✗	—	F
White River Valley Supervisory Union	`owsu.org`	Windsor County	—	✗	✗	—	F
Burlington School District	`bsdweb.bsdvt.org`	Chittenden County	—	✗	✗	—	F
South Burlington Supervisory District	`district.sf.sbschools.net`	Chittenden County	—	✗	✗	—	F
Washington Central Supervisory Union	`wcsuonline.org`	Washington County	—	✗	✗	—	F

4.3 County-Level Summary (Top 10 Counties by District Count)

Table 8. Vermont County Distribution
County	Districts	Website Coverage
Orleans County	22	27.3%
Windsor County	22	77.3%
Windham County	20	55.0%
Chittenden County	17	88.2%
Bennington County	14	50.0%
Rutland County	14	78.6%
Washington County	13	92.3%
Caledonia County	12	75.0%
Franklin County	11	72.7%
Orange County	11	81.8%

5. Policy Implications

These findings identify specific, actionable gaps in Vermont's K-12 email security posture. The 64.3% DMARC gap represents districts that can be impersonated by any sender, enabling phishing campaigns targeting parents, students, and educators with no authentication failure. Key observations:

Immediate risk: 32 districts (45.7%) have Grade F scores, indicating minimal or no email authentication. These represent the highest-priority remediation targets.
Mid-tier stagnation: 15 districts (21.4%) are in the C range — typically have SPF but no DMARC or weak DMARC (p=none). Upgrading to p=quarantine would move them to B without infrastructure changes.
Provider leverage: Google Workspace (used by 64.3% of scored districts) provides automated SPF/DKIM configuration. Districts on Google Workspace with Grade F scores have misconfigured or missing DMARC — a free and simple fix.

6. Data Availability

The full Vermont K-12 dataset — 183 entities with NCES CCD enrichment (phone, address, grade span, school count, LEAID) and DNS authentication profiles — is available as part of the Lokentra ESI State Pack.

Table 9. Licensing Tiers
Tier	Scope	Suggested Use
State Pack: Vermont	All 183 K-12 LEAs, full DNS profile + CCD enrichment	Regional studies, state policy, outreach
K-12 National	All 50 states, 20,021+ K-12 LEAs	National K-12 cybersecurity research
Full Registry	801,359+ entities across all sectors	Comprehensive multi-sector research
API + Updates	Quarterly re-scan, REST API	Longitudinal studies, live dashboards

Contact: research@monitorworkspace.com — Free demo at monitorworkspace.com/scorecard

Citation: Lokentra Research Team (2026). Vermont K-12 Email Security Intelligence: DNS Authentication Profiling of 183 School District LEAs. Lokentra U.S. Email Security Index (ESI) — State Intelligence Series. https://lokentra-site.web.app/research/states/vt-k12-paper.html

Data sources: NCES Common Core of Data (CCD) 2024-2025; DNS records resolved via Google Public DNS (8.8.8.8) and Cloudflare (1.1.1.1). All entity data derived from publicly accessible government registries.

National baseline figures from Lokentra U.S. Education Sector Email Security Intelligence Dataset (March 2026). See education-dataset-paper.html for full methodology.

Vermont K-12 Email Security Intelligence:DNS Authentication Profiling of 183 School District LEAs