42% of US County Election Websites Lack .gov Domains, Exposing Voters to Impersonation Risks
What Happened — A 2026 study by Mysterium VPN examined 2,081 county‑run election information sites across the United States. It found that 869 sites (42 %) still use non‑.gov domains, down from 57 % in 2024 but still a sizable exposure. When weighted by population, 28 % of U.S. residents live in counties whose election pages are on non‑government domains. The report also flagged weak email authentication (e.g., use of consumer‑grade email addresses) and inconsistent TLS deployment, which together increase the chance that attackers could create convincing spoof sites or phishing emails to mislead voters. The study does not indicate any compromise of voting machines or ballot‑counting systems, but it highlights a systemic trust gap in public‑facing election portals.
Why It Matters for Trust & Control Assurance — The findings test the control objective of domain ownership verification and email authentication—a single control that satisfies many governance frameworks (e.g., NIST CSF 2.0) and underpins voter confidence. Verisq’s Access Controls capability helps organizations continuously evidence that only authorized, government‑validated domains and mail servers are used.
Who Is Affected — State and local government election offices, public‑sector web hosting providers, and any third‑party vendors that manage county election sites.
Recommended Actions
- Inventory all election‑related web properties and confirm that each is hosted on a registered .gov domain.
- Implement DMARC, SPF, and DKIM for all official election‑office email addresses; retire consumer‑grade mail accounts.
- Deploy automated monitoring to detect domain‑name changes or unauthorized TLS certificate issuance.
- Document the domain‑ownership and email‑auth controls in your audit evidence repository.
Technical Notes
- Attack vector: Misconfiguration of domain naming and email authentication (phishing, spoofing).
- Data types exposed: Voter registration information, polling‑place locations, ballot‑tracking URLs.
- Relevant guidance: FBI and CISA advisories on fake election sites; NIST 800‑63B recommendations for digital identity proofing.