U.S. Education Sector Email Security Intelligence Dataset:
A Multi-Source Entity Registry with DNS Authentication Profiling

1. Introduction

Email remains the primary attack vector against educational institutions. Phishing campaigns targeting school districts have increased substantially, with the FBI's Internet Crime Complaint Center (IC3) reporting education as the most-targeted sector for ransomware incidents in 2023-2024. Despite growing federal attention to government cybersecurity, Binding Operational Directive (BOD) 18-01 — which mandated DMARC at enforcement level for federal agencies — does not extend to the approximately 130,000 K-12 schools and 6,000+ postsecondary institutions operating across the United States.

The security posture of these education entities is largely unmeasured. Existing studies focus on federal .gov domains or narrow state-level samples. No prior work has attempted a comprehensive, entity-attributed DNS analysis covering all U.S. K-12 districts and accredited institutions with email provider classification, security gateway detection, and authentication scoring.

This paper makes three contributions:

1. A nationwide education entity registry linking 23,192 education entities to their internet domains, sourced from NCES CCD (2024-2025), IPEDS, and state education agency directories.
2. Full-spectrum DNS profiling of education domains across seven record types, with email provider classification, gateway detection, and a 100-point authentication score.
3. Empirical findings on the K-12/higher-ed security divide, the Google-Microsoft bifurcation, and the gateway adoption gap — with implications for federal cybersecurity policy.

2. Dataset Overview

2.1 Full Lokentra ESI Registry

2.2 Education Subset

3. Methodology

3.1 Entity Collection

Education entities were collected from three primary source categories:

The CCD 2024-2025 file (ccd_lea_029_2425_w_1a_073025.csv) provides 19,630 LEA records, of which 19,281 have SY_STATUS=1 (Open). These were ingested via a deterministic pipeline that matches existing entities by NCES LEAID and inserts unmatched entities as new records. The CCD file provides phone numbers, physical and mailing addresses, grade span, operational school count, charter status, and LEA type classification for 100% of open LEAs.

3.2 DNS Profiling Pipeline

Each entity's website URL is resolved to its apex domain, then profiled across seven DNS record types (A, CNAME, MX, NS, SPF, DMARC, SOA) using parallel resolution. The pipeline classifies email providers from MX records, detects third-party email security gateways by comparing MX and SPF records, infers the underlying mailbox platform behind proxies, and scores each domain on a 100-point authentication rubric. Entities are deduplicated via SHA-1 hash of normalized name, type, and county.

3.3 Scoring Rubric

DMARC receives the highest weight (40%) because it is the only protocol that directly prevents domain spoofing in the From: header — the field end users see and trust.

4. The Human Impact: Populations at Risk

Email security gaps are not abstract technical metrics. To estimate the human exposure, we combined operational school counts from the CCD 2024-2025 file (100,081 schools across 19,281 matched K-12 districts) with NCES national averages: 381 students per school, 51 staff and educators per school, and 2 parents or guardians per student.

More than 53 million people — students, parents, and educators — are associated with K-12 districts that lack DMARC email authentication. Their districts can be impersonated by anyone sending a spoofed email. An additional 22.9 million are in Grade F districts with minimal or no email authentication at all. These are children, families, and teachers whose school communications can be forged without detection.

Estimates use NCES 2023-2024 national averages applied to operational school counts from CCD 2024-2025. Individual district enrollment data can be linked via NCES LEAID for precise counts.

5. Findings

5.1 Email Provider Bifurcation

K-12 districts overwhelmingly use Google Workspace, consistent with Google Workspace for Education's free or heavily discounted licensing for K-12. Higher education institutions invert this pattern, favoring Microsoft 365 at a 2.9:1 ratio. This is the first empirical quantification of this bifurcation at national scale.

5.2 Email Authentication Adoption

44.5% of K-12 domains have no DMARC record. These districts are fully vulnerable to domain spoofing — an attacker can send email appearing to come from superintendent@district.org and it will be delivered to recipients' inboxes without authentication failure. Higher education achieves 89.0% DMARC adoption, a 33.5 percentage-point lead likely attributable to larger IT teams, dedicated security staff, and higher cybersecurity awareness.

5.3 Email Security Gateway Adoption

Only 8.2% of K-12 districts route mail through a third-party email security gateway (Barracuda, Proofpoint, Mimecast, etc.), the lowest rate of any public-sector entity type. Domains using gateways exhibit substantially stronger authentication posture:

5.4 Provider-Security Correlation

Email infrastructure choice is strongly predictive of security posture. Districts using budget hosting providers exhibit SPF rates as low as 7.3% (GoDaddy), rendering them effectively unprotected. The vendor ecosystem a district selects determines its security floor.

6. Dataset Schema

7. Research Applications

7.1 Education Policy

• Cybersecurity readiness assessment — identify the most vulnerable states and districts
• Federal mandate gap analysis — model the impact of extending BOD 18-01 to K-12
• Digital equity — correlate email security with district funding, rurality, and demographics via NCES LEAID linkage
• State policy effectiveness — compare states with and without cybersecurity mandates

7.2 EdTech and Procurement

• Cloud adoption patterns — quantify Google vs. Microsoft market share by segment and state
• Vendor lock-in — analyze switching barriers created by free Google Workspace for Education
• Email security gateway TAM — 8,200+ K-12 districts without gateways represent an addressable market

7.3 Cybersecurity Research

• Phishing risk modeling — map authentication gaps to phishing exposure at the district level
• DMARC deployment barriers — investigate why 48% of K-12 lacks DMARC despite having SPF
• Longitudinal tracking — use this dataset as a baseline for measuring future adoption

8. Cross-Sector Benchmarking

The ESI scoring rubric is applied uniformly across the full entity registry, enabling cross-sector comparisons:

9. Limitations

• Website coverage. 3,467 K-12 entities (15.2%) lack a website URL, precluding DNS analysis. These tend to be small charter LEAs or specialized agencies.
• County field sparsity. The CCD LEA file does not include county; county attribution for newly inserted entities requires secondary enrichment via NCES LEAID.
• DNS temporal validity. DNS records are subject to change. The analysis was conducted at a point in time (March 2026) and does not reflect subsequent migrations.
• DKIM selector enumeration. Only common Google Workspace and Microsoft 365 selectors are checked. Entities using non-standard selectors may be underscored.
• Gateway classification. 39.8% of proxied domains have "Unknown" underlying provider, meaning true Google/M365 adoption is higher than MX-visible counts.

10. Data Availability

Delivery formats: CSV/Parquet, SQLite (pre-indexed), REST API, or interactive dashboard. All deliveries include full methodology documentation, source provenance, data dictionary, and reproducibility scripts (Python).

Contact: research@monitorworkspace.com

Free demo: monitorworkspace.com/scorecard