Washington K-12 Email Security Intelligence:
DNS Authentication Profiling of 348 School District LEAs

Lokentra Research Team

Lokentra U.S. Email Security Index (ESI) — State Intelligence Series

April 22, 2026

research@monitorworkspace.com • monitorworkspace.com/scorecard

Abstract

We present DNS email security profiling for 348 K-12 LEAs in Washington, of which 220 have active domains (63.2% coverage). Domains were scored on the Lokentra 100-point Email Security Index (ESI) rubric (SPF 30 pts + DKIM 30 pts + DMARC 40 pts). Washington K-12 districts achieve an average ESI score of 59.4/100, with 43.6% earning Grade A or B (strong posture) and 20.0% receiving Grade F (minimal authentication). Only 64.5% have any DMARC record, and just 37.3% have DMARC at an enforcement level (quarantine or reject) — leaving 35.5% of districts fully vulnerable to email domain spoofing. This report provides entity-level data for all 220 scored domains including provider classification, authentication status, and ESI score, sourced from NCES CCD 2024-2025 and live DNS resolution conducted April 22, 2026.

Keywords: Washington, K-12 email security, DMARC, SPF, school district cybersecurity, DNS authentication, Google Workspace, education technology

1. Dataset Overview

Table 1. Washington K-12 Dataset Summary
Metric	Value
Total K-12 LEAs in state	348
Regular school districts	306
Charter LEAs	16
Other LEA types (state-operated, regional, etc.)	26
LEAs with active internet domain	220 (63.2%)
Domains DNS-profiled	220
Data freshness (NCES CCD)	2024-2025 school year
DNS scan date	April 22, 2026

2. The Human Impact: Populations at Risk

To estimate human exposure, NCES national averages are applied to CCD 2024-2025 operational school counts: 381 students per school, 51 staff per school, and 2 parents or guardians per student. Washington K-12 districts collectively operate approximately 2,541 schools.

Table 2. Estimated Population Exposure from K-12 Email Security Gaps — Washington
Population	Total in Dataset	At Risk (No DMARC, 35.5%)	Critically Exposed (Grade F, 20.0%)
Students	968,121	343,682	193,624
Parents and guardians	1,936,242	687,365	387,248
Staff and educators	129,591	46,004	25,918
Total people	3,033,954	1,077,053	606,790

Estimates based on NCES national averages. Individual district enrollment data can be linked via NCES LEAID for precise counts.

3. Authentication Findings

3.1 Protocol Adoption

Table 3. Email Authentication Protocol Adoption — Washington K-12
Protocol	Washington	National K-12 (ESI)	vs. National
SPF (any configuration)	85.5%	79.7%	+5.8pp
DKIM (key published)	67.3%	59.6%	+7.7pp
DMARC (any policy)	64.5%	55.5%	+9.0pp
DMARC at enforcement (quarantine/reject)	37.3%	~21.0%	+16.3pp
DMARC at reject (full enforcement)	13.6%	~12.2%	+1.4pp
No MX records (not receiving email)	6.4%	~10.0%	-3.6pp

3.2 ESI Grade Distribution

Table 4. ESI Score Grade Distribution — Washington K-12
Grade	Score	Districts	Share	Interpretation
A	90–100	46	20.9%	Full enforcement
B	70–89	50	22.7%	Strong posture
C	50–69	53	24.1%	Partial protection
D	30–49	27	12.3%	Weak configuration
F	0–29	44	20.0%	Minimal/no authentication
Average score		59.4 / 100

3.3 Email Provider Distribution

Table 5. Email Provider Distribution — Washington K-12 (top providers)
Provider	Districts	Share
Google Workspace	127	57.7%
Microsoft 365	59	26.8%
Barracuda	5	2.3%
Mimecast	2	0.9%
Fortinet	1	0.5%
GoDaddy	1	0.5%

4. District-Level Data

4.1 Top Performing Districts (Best ESI Scores)

Table 6. Top 15 Washington K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Score	Grade
Educational Service District 101	`esd101.net`	Spokane County	Microsoft 365	✓	✓	reject	100	A
Almira School District	`almirasd.org`	Lincoln County	Google Workspace	✓	✓	reject	100	A
Everett Community College	`everettcc.edu`	Snohomish County	Google Workspace	✓	✓	reject	100	A
College Place School District	`cpps.org`	Walla Walla County	Google Workspace	✓	✓	reject	100	A
Freeman School District	`freemansd.org`	Spokane County	Microsoft 365	✓	✓	reject	100	A
Granite Falls School District	`gfalls.wednet.edu`	Snohomish County	Microsoft 365	✓	✓	reject	100	A
Harrington School District	`harringtonsd.org`	Lincoln County	Google Workspace	✓	✓	reject	100	A
Kennewick School District	`ksd.org`	Benton County	Microsoft 365	✓	✓	reject	100	A
La Center School District	`lacenterschools.org`	Clark County	Google Workspace	✓	✓	reject	100	A
Mukilteo School District	`mukilteoschools.org`	Snohomish County	Microsoft 365	✓	✓	reject	100	A
Othello School District	`othelloschools.org`	Adams County	Google Workspace	✓	✓	reject	100	A
Quilcene School District	`qsd48.org`	Jefferson County	Google Workspace	✓	✓	reject	100	A
Reardan-Edwall School District	`reardan.net`	Lincoln County	Google Workspace	✓	✓	reject	100	A
Sunnyside School District	`sunnysideschools.org`	Yakima County	Google Workspace	✓	✓	reject	100	A
Tekoa School District	`tekoasd.org`	Whitman County	Google Workspace	✓	✓	reject	100	A

4.2 Districts Most in Need of Improvement (Lowest ESI Scores)

Table 7. Bottom 15 Washington K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Grade
Green River College	`grcc.greenriver.edu`	King County	—	✗	✗	—	F
Lumen Public School	`lumenhighschool.org`	Spokane County	Google Workspace	✗	✗	—	F
Pullman Community Montessori	`pullmancommunitymontessori.org`	Whitman County	—	✗	✗	—	F
Bates Technical College	`bates.ctc.edu`	Pierce County	—	✗	✗	—	F
Centralia School District	`centraliaschooldistrict.org`	Lewis County	—	✗	✗	—	F
Columbia (Stevens) School District	`columbia206.com`	Stevens County	Google Workspace	✗	✗	—	F
Darrington School District	`darringtonschools.org`	Snohomish County	—	✗	✗	—	F
Goldendale School District	`goldendaleschools.org`	Klickitat County	—	✗	✗	—	F
Issaquah School District	`isd411.org`	King County	—	✗	✗	—	F
Kahlotus School District	`kahlotussd.org`	Franklin County	Google Workspace	✗	✗	—	F
Mary M Knight School District	`marymknight.com`	Mason County	—	✗	✗	—	F
Pomeroy School District	`psd.wedne.edu`	Garfield County	—	✗	✗	—	F
Orcas Island School District	`orcasislandschools.org`	San Juan County	GoDaddy	✗	✗	—	F
Pullman School District	`pullmanschools.org`	Whitman County	—	✗	✗	—	F
Star School District No. 054	`starsd.org`	Franklin County	Google Workspace	✗	✗	—	F

4.3 County-Level Summary (Top 10 Counties by District Count)

Table 8. Washington County Distribution
County	Districts	Website Coverage
King County	33	66.7%
Pierce County	20	45.0%
Spokane County	19	84.2%
Yakima County	16	75.0%
Snohomish County	16	75.0%
Whitman County	15	46.7%
Lewis County	14	57.1%
Clark County	13	69.2%
Grays Harbor County	13	69.2%
Stevens County	12	66.7%

5. Policy Implications

These findings identify specific, actionable gaps in Washington's K-12 email security posture. The 35.5% DMARC gap represents districts that can be impersonated by any sender, enabling phishing campaigns targeting parents, students, and educators with no authentication failure. Key observations:

Immediate risk: 44 districts (20.0%) have Grade F scores, indicating minimal or no email authentication. These represent the highest-priority remediation targets.
Mid-tier stagnation: 53 districts (24.1%) are in the C range — typically have SPF but no DMARC or weak DMARC (p=none). Upgrading to p=quarantine would move them to B without infrastructure changes.
Provider leverage: Google Workspace (used by 57.7% of scored districts) provides automated SPF/DKIM configuration. Districts on Google Workspace with Grade F scores have misconfigured or missing DMARC — a free and simple fix.

6. Data Availability

The full Washington K-12 dataset — 348 entities with NCES CCD enrichment (phone, address, grade span, school count, LEAID) and DNS authentication profiles — is available as part of the Lokentra ESI State Pack.

Table 9. Licensing Tiers
Tier	Scope	Suggested Use
State Pack: Washington	All 348 K-12 LEAs, full DNS profile + CCD enrichment	Regional studies, state policy, outreach
K-12 National	All 50 states, 20,021+ K-12 LEAs	National K-12 cybersecurity research
Full Registry	801,359+ entities across all sectors	Comprehensive multi-sector research
API + Updates	Quarterly re-scan, REST API	Longitudinal studies, live dashboards

Contact: research@monitorworkspace.com — Free demo at monitorworkspace.com/scorecard

Citation: Lokentra Research Team (2026). Washington K-12 Email Security Intelligence: DNS Authentication Profiling of 348 School District LEAs. Lokentra U.S. Email Security Index (ESI) — State Intelligence Series. https://lokentra-site.web.app/research/states/wa-k12-paper.html

Data sources: NCES Common Core of Data (CCD) 2024-2025; DNS records resolved via Google Public DNS (8.8.8.8) and Cloudflare (1.1.1.1). All entity data derived from publicly accessible government registries.

National baseline figures from Lokentra U.S. Education Sector Email Security Intelligence Dataset (March 2026). See education-dataset-paper.html for full methodology.

Washington K-12 Email Security Intelligence:DNS Authentication Profiling of 348 School District LEAs