Can someone send email as your county?
We checked the email and website security of every county government in South Carolina. In 34 of 46 counties, nothing stops a stranger from sending email that appears to come from the county’s own address, and most inboxes will deliver it. Election Day is November 3, and county election offices email voters.
How we did this, and what it doesn’t say
We took each county’s official website from the South Carolina Association of Counties directory and, on October 25, 2026, read the public DNS records for that domain (mail servers, SPF, DMARC and DNSSEC) through a public resolver, then requested each county’s home page once, the way any visitor’s browser does. Seven county sites answered that request with a firewall block page, so their browser protections are left out of those figures. Nothing was logged into, scanned for weaknesses or tested against. Anyone can repeat every check with our free email check and website check.
We measured the domain each county uses for its website. A few counties may send their own mail from a different domain; that doesn’t change the finding, because a scammer can forge the address residents see on the website whether or not the county sends from it. Four of the 46 website domains don’t receive mail at all, and those need a reject policy most of all, since nobody would notice forgeries. DNS changes quickly: a county that fixes its records today will show the new result in our checker straight away.
Email: who can pretend to be the county
34 of 46 counties don’t stop someone sending email that looks like it came from the county.
17 publish no DMARC policy at all, 16 publish one set to monitor only, and 1 enforces on only part of its mail.
17 of 46 counties have no DMARC record on the domain their website uses.
16 of 46 counties publish DMARC at p=none, which asks mailboxes to deliver forged mail anyway.
4 of 46 counties tell mailboxes to reject forged mail outright.
Anderson, Georgetown, Spartanburg and York. Eight more quarantine it, which sends forgeries to spam.
DMARC is a public DNS record that tells Gmail, Outlook and Yahoo what to do with mail that claims to be from a domain but can’t prove it. With no record, or a record set to p=none, forged mail is usually delivered. Set to p=reject, it’s refused. Publishing the record costs nothing; getting to reject takes a few weeks of reading the reports to make sure the county’s own mail passes first. Our step-by-step DMARC guide covers the process.
Why it matters this month
- ElectionsCounty voter registration and elections offices email voters, poll workers and candidates. A message about a changed polling place, a new ID rule or a “problem with your registration,” sent from the county’s real address in the last days before an election, is the kind of thing that spreads before anyone checks it.
- Tax billsSouth Carolina property tax bills go out in the fall and come due in January. A forged “pay your tax bill here” email from the county’s domain is an easy scam to run.
- Vendors and contractorsCounties pay contractors and suppliers. Changed bank details sent from a county address, or to a county from a forged vendor, is the classic business email compromise.
- Courts, permits and finesFake court notices and permit fees carry more weight when the sender looks like the county.
Domains: .gov helps, but doesn’t do it for you
23 of 46 counties use a .gov address (15 on .gov, 8 on the state’s sc.gov).
The rest are on .org (13), .com (7), .us (2) and .net (1). Anyone can register an address on those endings, so a convincing look-alike of a county’s domain is a few dollars away; .gov addresses are only issued to verified U.S. government organizations.
11 of 15 counties of the counties on plain .gov still let anyone forge their email.
.gov proves who owns the domain. It doesn’t publish a DMARC policy for you.
2 of 46 counties have DNSSEC validating on their domain.
- .com: email forgeable7 of 7
- .net: email forgeable1 of 1
- .us: email forgeable2 of 2
- .org: email forgeable10 of 13
- .gov: email forgeable11 of 15
- sc.gov: email forgeable3 of 8
A .gov address is only issued to verified U.S. government organizations, and CISA has offered .gov registration at no cost to eligible public organizations since 2021, so moving to one makes look-alike domains much less convincing. The counties on the state’s sc.gov addresses did best of any group. But 11 of the 15 counties on plain .gov still publish no enforced DMARC policy, so their exact address can still be forged. The domain ending and the DMARC record are two separate fixes.
Websites: HTTPS everywhere, protections patchy
35 of 46 county sites send a plain http:// visit on to the secure HTTPS version.
At least 4 serve the page over plain http without upgrading. The other 7 blocked our automated request, so we couldn’t tell.
39 of 39 county sites that loaded were missing at least one of six standard browser protections.
6 send none of the six, and 10 send two or fewer.
20 of 39 county sites send Strict-Transport-Security, which keeps visitors on HTTPS.
13 of 39 county sites send a Content-Security-Policy, the protection that blocks injected scripts.
Every county home page we could load is served over HTTPS, which is good news. The browser protections behind it are uneven. Strict-Transport-Security keeps visitors on the secure version, a Content-Security-Policy stops a script injected into the site from running, and the rest block framing by scam pages and leaking addresses to other sites. Our guide to security headers explains each one. Four county sites also announce their web server or PHP version in every response, which tells an attacker exactly what to look up.
What a county should do this week
- Check the domainType the county’s domain into our email check. It reads the SPF and DMARC records and says, in plain words, whether someone can send as you.
- Publish DMARC, then enforce itStart at
p=nonewith reporting turned on, confirm every system that sends county mail passes, then move to quarantine and reject. Domains the county doesn’t send from can go straight to reject. - Warn residents where they lookOn the elections and tax pages: “The county will never ask you to pay or update your registration through a link in an email. Call us at the number on this page.”
- Use the free help that existsCISA offers free services to state and local governments, including vulnerability scanning, and the .gov program at no cost. A county’s IT provider or the state can help with the DNS changes.
For residents
An email that looks like it’s from the county isn’t proof that it is. If a message asks you to pay, click to “verify” your voter registration, or act fast, go to the county’s website by typing the address yourself, or call the number listed there. Election information is also published by the South Carolina Election Commission at scvotes.gov.
Which counties?
Credit where it’s due: Anderson, Georgetown, Spartanburg and York reject forged mail outright. We’re not publishing which of the other counties fall into which group, because the point is to get it fixed, not to embarrass anyone right before an election. Any county administrator, IT department or elections office can ask us for its own full result, free, at our contact page or 843-331-6339, and anyone can check any domain with the email check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Research by Nikita Huttenlocher, security researcher and founder of Huttenlocher Technologies, a cybersecurity and software firm in Myrtle Beach, South Carolina. Journalists, county associations and election officials are welcome to quote these figures with a link to this page. The method and scripts are available on request. See also our study of all 72 school districts.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.