As reported by SecurityAffairs, Mysterium VPN's 2026 County Election Website Security Census reveals that 42% of identifiable US county election websites (869 of 2,081) still operate on non-.gov domains — down from 57% in 2024, but still a significant trust gap five days before a national election.

Key Takeaway: As reported by SecurityAffairs, Mysterium VPN's 2026 County Election Website Security Census reveals that 42% of identifiable US county election websites (869 of 2,081) still operate on non-.gov domains — down from 57% in 2024, but still a significant trust gap five days before a national election.

The Core Issue Isn't Technical — It's Trust Signal Degradation

The .gov domain isn't a security panacea, but it functions as a critical verifiable trust anchor for voters. Only verified US government organizations can register .gov domains through the Cybersecurity and Infrastructure Security Agency (CISA). When a county election office runs its voter information site on a .org, .us, or commercial hosting subdomain, it removes the single most accessible signal ordinary citizens can use to distinguish official sources from impersonation.

The FBI and CISA have already warned that threat actors deploy fake election websites to spread disinformation and harvest personal data. The attack surface grows proportionally with every legitimate site that normalizes the idea that election information can come from non-.gov addresses.

Three Attack Vectors the Report Surfaces

1. Domain Impersonation

Non-.gov county sites create look-alike opportunities. An attacker registering countyname-elections.com when the real site is co.countyname.tx.us exploits minimal user discernment. Texas alone has 169 non-.gov sites — 134 using the legacy co.<county>.tx.us structure — making it the highest-density target environment for typosquatting and brand confusion campaigns.

2. Email Authentication Gaps

The report also flags weak email authentication (SPF/DKIM/DMARC) on county-controlled domains. Election offices routinely email voters about registration status, ID requirements, and missing ballots. Without properly enforced DMARC alignment, these communications can be spoofed — enabling phishing that looks like legitimate election office correspondence. This is a direct voter manipulation vector, not just a spam problem.

3. Third-Party Tracking Exposure

Commercial trackers on election information pages collect data about voter behavior — which pages they visit, when, and from where. While not a direct compromise of voting systems, it creates privacy exposure and could enable targeted disinformation campaigns keyed to specific demographics or geographies.

Population-Weighted Reality vs. Headline Numbers

The 42% figure overstates the exposure for most Americans. Weighted by population, only 28% of residents live in counties with non-.gov election sites — meaning large jurisdictions have already migrated. But this also means the remaining non-.gov sites are concentrated in smaller, less-resourced counties that are least equipped to handle security incidents or disinformation fallout.

This is a classic resource asymmetry problem. The counties most likely to be targeted for impersonation — those with limited IT staff, legacy infrastructure, and lower cybersecurity budgets — are precisely the ones still operating outside the .gov trust framework.

Shield53 Recommendations

For Election Offices (Immediate)

Population-Weighted Reality vs. Headline Numbers
Request a .gov domain through CISA's .gov registration process if you haven't already. Legacy domains should redirect (301) to the .gov address.
Enforce DMARC at p=reject on all email-sending domains used for voter communication. At minimum, start with p=quarantine and monitor DMARC reports.
Audit third-party scripts on election information pages. Remove non-essential trackers and implement Content Security Policy headers.
Deploy HSTS and ensure all pages enforce HTTPS with valid certificates.

For Voters and Civic Organizations

  • Verify any election website URL ends in .gov before entering personal information.
  • Confirm polling place information through multiple sources — your state's Secretary of State site is a reliable cross-check.
  • Be skeptical of election-related emails asking for personal data, even if they appear official. Call your county election office directly using a number from the .gov site.

For State-Level Election Directors

  • Prioritize funding and technical support for smaller counties still on legacy domains — Texas, in particular, needs a coordinated migration effort.
  • Establish state-wide DMARC monitoring for county election email domains before November 3.
  • Coordinate with CISA's Election Infrastructure ISAC for threat intelligence sharing on impersonation domains.

Broader Implications

The 2026 census shows measurable progress (57% → 42% non-.gov in two years), but progress at this pace won't close the trust gap before the next major election cycle. The remaining non-.gov counties represent the hardest population to migrate — legacy infrastructure, political inertia, and resource constraints all compound. Election security is fundamentally an exercise in public trust, and every non-.gov domain is a crack in that trust architecture that adversaries can exploit for disinformation, phishing, and voter suppression campaigns. The technical fixes are known and available. What's needed is execution velocity and resource allocation to the counties that need it most.