Review Finds 42% of County Election Sites on Non-.gov Domains

Key points

• Researchers reviewed county election pages used by voters across U.S. counties.
• 42% of those sites ran on domains outside .gov.
• Many showed weak email safeguards and third-party tracking.
• Millions of voters could face exposure; no CVE was cited.

A security review dated November 3 examined county-run election pages across the United States and found that 42 percent of them sit on addresses outside the .gov space. The research team focused on sites residents turn to for voting information, making the findings directly relevant to public trust and exposure to risk for voters.

Because those pages are often the first stop for polling-place details and ballot guidance, any weakness can affect millions of residents in U.S. counties. The review also flagged poor email authentication safeguards and the presence of external tracking scripts. Weak email settings make it easier for attackers to spoof official messages, while third-party tracking can leak visitor data or expand the attack surface. Neither issue requires a software flaw with a CVE; the study cited none.

Officials should treat the domain gap as a governance and procurement problem, not just a web-team issue. A county site hosted on a non-.gov address may fall outside standard monitoring, incident response, and brand-protection controls. The same applies to pages that load ad-tech or analytics from unknown vendors.

With the November 3 date in view, election offices should verify every public-facing link, redirect, and form before peak traffic. The research does not show an active breach, but it does show a broad exposure pattern that attackers could exploit through phishing, impersonation, or data collection. The priority is to close the obvious gaps and keep monitoring.

What to do now

1. Inventory every public election-facing domain and subdomain; flag any host not ending in .gov and migrate or front it with a managed .gov service.
2. Publish DMARC at p=reject with SPF and DKIM for all election-office mail domains, then monitor aggregate reports.
3. Audit voter-facing pages for third-party scripts; remove nonessential trackers and require approval for any analytics vendor.
4. Deploy a restrictive Content-Security-Policy, Subresource Integrity, and referrer controls to limit external calls.
5. Add a security contact and vulnerability disclosure path, and monitor for lookalike domains impersonating election offices.
6. Before November 3, run a configuration review of TLS, redirects, forms, and embedded content on every county election page.

Original source

Security Affairs