Virginia Local Government — Digital Trust Audit

The State of Municipal Email Security

An independent audit of email authentication controls across 135 Virginia jurisdictions.

Citizens trust local government communications by default. However, a massive gap exists between perceived authority and technical reality.

This independent audit measures observable exposure by analyzing SPF, DKIM, and DMARC enforcement according to current RFC standards. By checking the public DNS configurations of every county and city in the Commonwealth, we establish a verifiable baseline of operational maturity. These are the identical signals used by major corporate filters (like Gmail and Outlook) to determine if an email is a legitimate government communication or a phishing attempt.

135

Jurisdictions Audited

65%

Vulnerable to Spoofing

38%

Lack DMARC or DKIM

Commonwealth Average

79.1 / 100 | Grade: C

Virginia Local Government Email Security Rankings

Ranked by Email Identity Maturity Score (highest to lowest). Score out of 100.

Last Updated: April 24, 2026

Legend:
Active - DMARC enforcement is active. Domain is protected against spoofing.
Vulnerable - DMARC is missing or in monitoring mode. Domain can be spoofed by attackers.

Rank	Entity Name	Domain	Spoof Protection	Score
1	Botetourt County	botetourtva.gov	Active	100
2	Bristol	bristolva.org	Active	100
3	Colonial Heights	colonialheightsva.gov	Active	100
4	Dickenson County	dickensonva.org	Active	100
5	Fairfax County	fairfaxcounty.gov	Active	100
6	Fluvanna County	fluvannacounty.org	Active	100
7	Frederick County	fcva.us	Active	100
8	Galax	galaxva.com	Active	100
9	Goochland County	goochlandva.us	Active	100
10	Grayson County	graysoncountyva.gov	Active	100
11	Greensville County	greensvillecountyva.gov	Active	100
12	Harrisonburg	harrisonburgva.gov	Active	100
13	Highland County	highlandcova.org	Active	100
14	Hopewell	hopewellva.gov	Active	100
15	James City County	jamescitycountyva.gov	Active	100
16	Lee County	leecova.org	Active	100
17	Lexington	lexingtonva.gov	Active	100
18	Loudoun County	loudoun.gov	Active	100
19	Middlesex County	co.middlesex.va.us	Active	100
20	Radford	radfordva.gov	Active	100
21	Roanoke County	roanokecountyva.gov	Active	100
22	Salem	salemva.gov	Active	100
23	Washington County	washcova.com	Active	100
24	Wythe County	wytheco.org	Active	100
25	York County	yorkcounty.gov	Active	100
26	Alexandria	alexandriava.gov	Active	97
27	Appomattox County	appomattoxcountyva.gov	Active	97
28	Charlottesville	charlottesville.gov	Active	97
29	Chesapeake	cityofchesapeake.net	Active	97
30	Fredericksburg	fredericksburgva.gov	Active	97
31	Bedford County	bedfordcountyva.gov	Active	95
32	Caroline County	co.caroline.va.us	Active	95
33	Powhatan County	powhatanva.gov	Active	95
34	Prince William County	pwcva.gov	Active	95
35	Chesterfield County	chesterfield.gov	Active	92
36	Falls Church	fallschurchva.gov	Active	92
37	Greene County	greenecountyva.gov	Active	92
38	Accomack County	co.accomack.va.us	Active	90
39	Alleghany County	co.alleghany.va.us	Active	90
40	Montgomery County	montgomerycountyva.gov	Active	90
41	Patrick County	co.patrick.va.us	Active	90
42	Albemarle County	albemarle.org	Active	88
43	Governor	governor.virginia.gov	Active	87
44	Charles City County	charlescityva.us	Vulnerable	85
45	Cumberland County	cumberlandcounty.virginia.gov	Vulnerable	85
46	Essex County	essex-virginia.org	Vulnerable	85
47	Henry County	henrycountyva.gov	Vulnerable	85
48	Louisa County	louisacounty.com	Active	85
49	Lynchburg	lynchburgva.gov	Vulnerable	85
50	Madison County	madisonco.virginia.gov	Vulnerable	85
51	Mecklenburg County	mecklenburgva.com	Vulnerable	85
52	Norfolk	norfolk.gov	Vulnerable	85
53	Northampton County	co.northampton.va.us	Active	85
54	Portsmouth	portsmouthva.gov	Vulnerable	85
55	Shenandoah County	shenandoahcountyva.us	Vulnerable	85
56	Spotsylvania County	spotsylvania.va.us	Vulnerable	85
57	Suffolk	suffolkva.us	Vulnerable	85
58	Winchester	winchesterva.gov	Vulnerable	85
59	Amelia County	ameliacova.com	Vulnerable	82
60	Carroll County	carrollcountyva.gov	Vulnerable	82
61	Clarke County	clarkecounty.gov	Active	82
62	Culpeper County	culpepercounty.gov	Vulnerable	82
63	Giles County	gilescounty.org	Vulnerable	82
64	Hampton	hampton.gov	Vulnerable	82
65	Lancaster County	lancova.com	Vulnerable	82
66	Prince George County	princegeorgecountyva.gov	Vulnerable	82
67	Virginia State	virginia.gov	Vulnerable	82
68	Campbell County	co.campbell.va.us	Vulnerable	80
69	Henrico County	henrico.gov	Active	80
70	Orange County	orangecountyva.gov	Vulnerable	80
71	Smyth County	smythcounty.org	Vulnerable	80
72	Surry County	surrycountyva.gov	Vulnerable	80
73	Warren County	warrencountyva.gov	Vulnerable	80
74	Danville	danvilleva.gov	Vulnerable	78
75	Craig County	craigcountyva.gov	Vulnerable	77
76	Fauquier County	fauquiercounty.gov	Vulnerable	77
77	Hanover County	hanovercounty.gov	Vulnerable	77
78	Newport News	nnva.gov	Vulnerable	77
79	Norton	nortonva.gov	Vulnerable	77
80	Rappahannock County	rappahannockcountyva.gov	Vulnerable	77
81	Richmond City	rva.gov	Vulnerable	77
82	Roanoke City	roanokeva.gov	Vulnerable	77
83	Stafford County	staffordcountyva.gov	Vulnerable	77
84	Franklin County	franklincountyva.gov	Vulnerable	75
85	King William County	kingwilliamcounty.us	Vulnerable	75
86	Lunenburg County	lunenburgva.gov	Vulnerable	75
87	Manassas	manassasva.gov	Vulnerable	75
88	Pulaski County	pulaskicounty.org	Vulnerable	75
89	Rockbridge County	co.rockbridge.va.us	Vulnerable	75
90	Scott County	scottcountyva.gov	Vulnerable	75
91	Arlington County	arlingtonva.us	Vulnerable	72
92	Franklin City	franklinva.com	Vulnerable	72
93	Manassas Park	cityofmanassaspark.us	Vulnerable	72
94	Poquoson	poquoson-va.gov	Vulnerable	72
95	Prince Edward County	co.prince-edward.va.us	Vulnerable	72
96	Russell County	russellcountyva.us	Vulnerable	72
97	Wise County	wisecounty.org	Vulnerable	72
98	Amherst County	countyofamherst.com	Vulnerable	70
99	Emporia	ci.emporia.va.us	Vulnerable	70
100	Rockingham County	rockinghamcountyva.gov	Vulnerable	70
101	Tazewell County	tazewellcountyva.org	Vulnerable	67
102	Brunswick County	brunswickco.com	Vulnerable	65
103	Buckingham County	buckinghamcountyva.org	Vulnerable	65
104	Charlotte County	charlotteva.com	Vulnerable	65
105	Floyd County	floydcova.org	Vulnerable	65
106	King and Queen County	kingandqueenco.net	Vulnerable	65
107	Mathews County	mathewscountyva.gov	Vulnerable	65
108	New Kent County	newkent-va.us	Vulnerable	65
109	Northumberland County	co.northumberland.va.us	Vulnerable	65
110	Nottoway County	nottoway.org	Vulnerable	65
111	Page County	pagecounty.virginia.gov	Vulnerable	65
112	Southampton County	southamptoncounty.org	Vulnerable	65
113	Williamsburg	williamsburgva.gov	Vulnerable	65
114	Augusta County	co.augusta.va.us	Vulnerable	63
115	Bath County	bathcountyva.gov	Vulnerable	62
116	Buchanan County	buchanancountyvirginia.gov	Vulnerable	62
117	Covington	covington.va.us	Vulnerable	62
118	Halifax County	halifaxcountyva.gov	Vulnerable	62
119	Martinsville	martinsville-va.gov	Vulnerable	62
120	Fairfax City	fairfaxva.gov	Vulnerable	60
121	Waynesboro	waynesboro.va.us	Vulnerable	60
122	Westmoreland County	westmoreland-county.org	Vulnerable	60
123	Buena Vista	buenavistava.gov	Vulnerable	58
124	Bland County	blandcountyva.gov	Vulnerable	57
125	Dinwiddie County	dinwiddieva.us	Vulnerable	57
126	Richmond County	co.richmond.va.us	Vulnerable	57
127	Gloucester County	gloucesterva.gov	Vulnerable	50
128	Sussex County	sussexcountyva.gov	Vulnerable	50
129	King George County	kinggeorgecountyva.gov	Vulnerable	45
130	Nelson County	nelsoncounty-va.gov	Vulnerable	45
131	Isle of Wight County	co.isle-of-wight.va.us	Vulnerable	35
132	Petersburg	petersburgva.gov	Vulnerable	35
133	Pittsylvania County	pittsylvaniacountyva.gov	Vulnerable	35
134	Staunton	staunton.va.us	Vulnerable	35
135	Virginia Beach	virginiabeach.gov	Vulnerable	35

Notice to Virginia IT Directors

If your jurisdiction has updated its DNS records or moved toward DMARC enforcement since this audit, we invite you to request a reassessment. Our goal is a secure Commonwealth. Once verified, your score will be updated to reflect your current posture.

Request Reassessment

Methodology Snapshot & Data

Scores are derived from public DNS analysis of SPF, DKIM, DMARC, reverse DNS, and domain identity posture. No internal systems were accessed. Data reflects the verification ecosystem as of April 2026.

Open Dataset

The aggregate scoring and failure rates are publicly available for independent analysis and research.

Download Aggregate JSON Data