Can someone email parents as your school district?
We checked every public school district in South Carolina. In 37 of 72, nothing stops a stranger from sending email that appears to come from the district’s own domain, and those districts serve about 284,000 students. The good news: their websites are among the best-protected public sites we’ve measured.
How we did this, and what it doesn’t say
The list of districts and their websites comes from the federal NCES Common Core of Data for the 2024-25 school year: every regular public school district in the state, 72 in all, leaving out the state-run Governor’s Schools. On October 25, 2026 we read each district’s public DNS records (mail servers, SPF, DMARC and DNSSEC) through two public resolvers, requested its home page once the way a visitor’s browser does, and read a few of its public contact and staff pages to see which domain its staff email from. Nothing was logged into, scanned for weaknesses or tested against. Anyone can repeat every check with our free email check and website check.
The headline figures measure the domain on each district’s website, the address parents see in every link and newsletter. Many districts don’t publish staff addresses where we could read them, so the staff-domain figure covers the 26 districts where we could confirm it. Enrollment is from the same federal data. DNS changes quickly; a district that fixes its records today will show the new result in our checker straight away.
Email: who can pretend to be the district
37 of 72 districts don’t stop someone sending email that looks like it came from the district’s website domain.
20 publish no DMARC policy, 13 publish one set to monitor only, and 4 enforce on only part of their mail. Together these districts serve about 284,000 students, 38% of the state’s district enrollment.
11 of 72 districts tell mailboxes to reject forged mail outright.
Anderson 3, Anderson 5, Clarendon, Florence 1, Horry County Schools, Laurens 56, Oconee, Spartanburg 1, Spartanburg 5, Spartanburg 6 and Fort Mill. Another 24 quarantine forgeries, which sends them to spam.
10 of 26 districts of the staff email domains we could confirm from districts’ own pages can be forged.
Several districts email from a different domain than their website. Where staff addresses were published on the district’s site, we checked that domain too.
15 of 22 districts of the districts still on the state’s older k12.sc.us addresses can be forged.
Compared with 22 of 50 on .org, .net and .com addresses.
DMARC is a public DNS record that tells Gmail, Outlook and Yahoo what to do with mail that claims to be from a domain but can’t prove it. With no record, or a record set to p=none, forged mail is usually delivered. Set to p=reject, it’s refused. Publishing it costs nothing; getting to reject takes a few weeks of reading the reports, because a district sends mail from more systems than most organizations: the student information system, the parent messaging service, payroll, nutrition and athletics. Our step-by-step DMARC guide covers the process.
Why it matters for schools
- Payroll and direct deposit“Please update my direct deposit” emails that appear to come from a teacher, or from the district itself, are a common scam aimed at school systems, and the FBI has warned about payroll diversion fraud in education. A forged message from the district’s own domain is harder for staff to question.
- ParentsFamilies act quickly on district email about closures, schedule changes, lunch balances, fees and field trips. A fake payment link from what looks like the district’s address is an easy scam to run.
- VendorsDistricts pay buses, food service, construction and technology vendors. A forged change of bank details, to or from a district address, is classic business email compromise.
- Student dataA convincing email from the district is the first step in phishing staff logins to the systems that hold student records.
Setup errors that break email security
8 of 72 districts have a broken or missing SPF record.
6 publish none at all, and 2 publish more than one, which mailboxes treat as an error for every message.
2 of 72 districts have DNSSEC validating on their domain.
SPF lists the services allowed to send for a domain, and only one SPF record is allowed. With none, or with two or three, mailboxes can’t check a district’s own mail, which can also push legitimate messages to spam. Our guide on fixing SPF explains the common errors.
Websites: the bright spot
72 of 72 districts serve their site over HTTPS and send plain http:// visits on to it.
71 of 72 districts send Strict-Transport-Security, which keeps visitors on HTTPS.
69 of 72 districts send a Content-Security-Policy, the protection that blocks injected scripts.
0 of 72 districts send all six standard browser protections.
Most send five. The two usually missing are X-Content-Type-Options (sent by 38) and Permissions-Policy (sent by 35).
District websites are far better protected than the county government sites in our county study: every one forces HTTPS, and nearly all send a Content-Security-Policy, the hardest protection to set up. Results this uniform across 72 separate districts suggest much of it comes from the school-website platforms many of them share. Either way, it shows the website side of security can be solved at scale. The email side is still each district’s own DNS, and that’s where the gap is.
What a district should do
- Check every domainThe website domain, the staff email domain, and any old domains still in use. Type each into our email check.
- List every system that sends mailStudent information, parent messaging, payroll and HR, nutrition, transportation, athletics, the website’s forms. Each needs to pass SPF or DKIM before you enforce.
- Publish DMARC, then enforce itStart at
p=nonewith reporting on, fix what fails, then move to quarantine and reject. Domains that don’t send mail can go straight to reject. - Make direct deposit changes a phone callA written rule that payroll changes requested by email are confirmed in person or by phone stops the payroll scam even when a mailbox is compromised.
- Use the free helpCISA offers free cybersecurity services and guidance to K-12 schools, and the nonprofit K12 SIX publishes practical guidance for district technology teams.
For parents and staff
An email that looks like it’s from your district isn’t proof that it is. If a message asks you to pay, log in, or change bank details, go to the district’s website by typing the address yourself, use the district’s app, or call the school. Staff: confirm any direct deposit or payroll change with HR in person or by phone.
Which districts?
Credit where it’s due: Anderson 3, Anderson 5, Clarendon, Florence 1, Horry County Schools, Laurens 56, Oconee, Spartanburg 1, Spartanburg 5, Spartanburg 6 and Fort Mill reject forged mail outright. We’re not publishing which other districts fall into which group; the point is to get it fixed. Any superintendent’s office or district technology department can ask us for its own full result, free, at our contact page or 843-331-6339, and anyone can check a domain with the email check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Research by Nikita Huttenlocher, security researcher and founder of Huttenlocher Technologies, a cybersecurity and software firm in Myrtle Beach, South Carolina. Journalists, school boards and parent groups are welcome to quote these figures with a link to this page. The method and scripts are available on request. See also our study of all 46 county governments.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.