Perimetry Cloud
FRStart free
Product
Resources
Pricing
FrançaisSign inStart free

Perimetry Research · November 2026 edition

How well do French town halls protect their website and e-mail?

We measured the website and e-mail domain of every commune listed in the official directory of the French administration: 34,946 communes, 26,232 domains, with the same passive checks as Perimetry Cloud. Here is what we found, and who gets it right.

Download the full report (PDF) About twenty pages: findings, charts, every table, recommendations for town halls and the methodology.

34,946
communes studied
58.6%
have a website on their own domain
52.6%
of town hall addresses are consumer mailboxes
6%
of graded communes get an A or a B

What stands out

52.6% of the town hall addresses in the directory are at Orange, Wanadoo, Gmail or another consumer provider. The town hall does not control that domain: nothing stops someone from opening a look-alike mailbox and writing to residents in its name.

Among communes with their own domain, 45.2% publish a DMARC policy, and 19.2% enforce it (quarantine or reject). Without an enforced policy, receiving servers generally deliver a message forged in the town hall’s name.

On the websites: 93.4% of the communes’ own sites have a valid certificate and 86.4% send visitors from HTTP to HTTPS.

22.1% of the communes’ domains are signed with DNSSEC.

Grades

Each commune with a domain of its own gets a score: the share of the checks below that it passes, among those that apply to it. 22,829 communes are graded; the average score is 47 out of 100.

A: 90 or more · B: 75 · C: 60 · D: 40 · E: 20 · F: under 20

  • A183 (0.8%)
  • B1,187 (5.2%)
  • C6,034 (26.4%)
  • D9,848 (43.1%)
  • E4,797 (21%)
  • F780 (3.4%)

Check by check

Share of the graded communes that pass each check, among those it applies to (the website checks only apply to communes with a site on their own domain).

Website

  • Valid HTTPS certificate93.4%

    The site answers over HTTPS with a certificate that is in date, issued for its name, and trusted by browsers. 18,429 of 19,725.

  • HTTP sends visitors to HTTPS86.4%

    Someone who types the address lands on the encrypted site, not on a page anyone on the network can read or alter. 17,052 of 19,725.

  • HSTS for six months or more28.3%

    Browsers remember to use HTTPS only, so the first unencrypted request cannot be hijacked. 5,534 of 19,588.

  • Basic protective headers26.1%

    X-Content-Type-Options: nosniff, and protection against being framed by another site (X-Frame-Options or CSP frame-ancestors). 5,108 of 19,588.

DNS

  • DNSSEC22.1%

    Answers about the domain are signed, so a resolver cannot be fed false addresses for the town hall’s site or mail. 5,055 of 22,829.

  • CAA record2.8%

    The domain names the certificate authorities allowed to issue certificates for it. 649 of 22,829.

E-mail

  • Strict SPF85.9%

    The domain lists the servers allowed to send its mail and asks receivers to reject or flag the others (-all or ~all). 19,604 of 22,812.

  • DMARC record45.2%

    The domain publishes a DMARC policy, the standard that ties SPF and DKIM to the visible sender. 10,320 of 22,812.

  • DMARC enforced19.2%

    The policy is quarantine or reject: messages forged in the town hall’s name go to spam or are refused, not delivered. 4,373 of 22,812.

  • Address on a public domain71.1%

    The town hall’s address is on its own domain or a shared public one, not on a consumer mailbox (Orange, Gmail…) it does not control. 16,051 of 22,591.

By size of commune

The same measures by number of inhabitants.

PopulationCommunesGradedAverageA or BOwn websiteConsumer mailbox
100,000 inhabitants or more42426635.7%100%0%
20,000 to 99,9994504496421.4%99.1%0%
5,000 to 19,9991,7851,7755913.9%98.3%0.7%
1,000 to 4,9997,8157,611506.1%94.2%15.6%
Under 1,00024,85412,952444.2%43.7%68.8%

Honour roll

12 communes pass every one of the ten checks. They are listed by population.

  1. Joué-lès-Tours (37)
  2. Biéville-Beuville (14)
  3. Marolles-les-Braults (72)
  4. Villers-Écalles (76)
  5. Saint-Léonard (76)
  6. Eurre (26)
  7. Beaurevoir (02)
  8. Saint-Aubin-sur-Scie (76)
  9. Caumont (27)
  10. Artemare (01)
  11. Bouville (76)
  12. Veules-les-Roses (76)

Best in each size band

The highest scores among communes with their own website (at least nine checks applying), up to fifteen per band.

100,000 inhabitants or more

  1. Montpellier (34)90
  2. Le Havre (76)90
  3. Orléans (45)90
  4. Bordeaux (33)89
  5. Nantes (44)80
  6. Le Mans (72)80
  7. Annecy (74)80
  8. Perpignan (66)80
  9. Rouen (76)80
  10. Mulhouse (68)80
  11. Marseille (13)78
  12. Toulouse (31)78
  13. Toulon (83)78
  14. Montreuil (93)78

20,000 to 99,999

  1. Joué-lès-Tours (37)100
  2. Béziers (34)90
  3. La Rochelle (17)90
  4. Mérignac (33)90
  5. Drancy (93)90
  6. Saint-Quentin (02)90
  7. Alès (30)90
  8. Bagneux (92)90
  9. Villenave-d'Ornon (33)90
  10. Châtillon (92)90
  11. La Garenne-Colombes (92)90
  12. Villemomble (93)90
  13. Le Plessis-Robinson (92)90
  14. Yerres (91)90
  15. Limeil-Brévannes (94)90

5,000 to 19,999

  1. Bourg-lès-Valence (26)90
  2. Gentilly (94)90
  3. Verneuil-sur-Seine (78)90
  4. Sin-le-Noble (59)90
  5. Elbeuf (76)90
  6. Senlis (60)90
  7. Arnouville (95)90
  8. Saint-Avertin (37)90
  9. Audincourt (25)90
  10. Les Ponts-de-Cé (49)90
  11. Nemours (77)90
  12. Andernos-les-Bains (33)90
  13. Saint-Cyr-sur-Mer (83)90
  14. Cesson (77)90
  15. Mouans-Sartoux (06)90

1,000 to 4,999

  1. Biéville-Beuville (14)100
  2. Marolles-les-Braults (72)100
  3. Villers-Écalles (76)100
  4. Saint-Léonard (76)100
  5. Eurre (26)100
  6. Beaurevoir (02)100
  7. Saint-Aubin-sur-Scie (76)100
  8. Caumont (27)100
  9. Artemare (01)100
  10. Bouville (76)100
  11. Claira (66)90
  12. Mandres-les-Roses (94)90
  13. Provin (59)90
  14. Ghyvelde (59)90
  15. Pézilla-la-Rivière (66)90

Under 1,000

  1. Veules-les-Roses (76)100
  2. Norroy-le-Veneur (57)90
  3. Moisson (78)90
  4. Jauldes (16)90
  5. Lavoûte-sur-Loire (43)90
  6. Saint-Étienne-Lardeyrol (43)90
  7. Salmiech (12)90
  8. Canly (60)90
  9. Ayen (19)90
  10. Barran (32)90
  11. Prunet (15)90
  12. Saint-Julien-de-Lampon (24)90
  13. Ambérieux (69)90
  14. Bailleul-le-Soc (60)90
  15. Vittefleur (76)90

Website platforms

Many communes publish their site on a platform (a site builder or a shared portal). Its security is then the platform’s, so we grade the platform, not the commune, on a sample of up to five communes’ sites there (a check counts as passed when most of the sample passes it). Platforms used by at least five communes, graded only when at least three of their sites could be checked:

PlatformCommunesGradeChecks passed
Jimdo95EValid HTTPS certificate, HTTP sends visitors to HTTPS
Wix73DValid HTTPS certificate, HTTP sends visitors to HTTPS, HSTS for six months or more
e-monsite60FValid HTTPS certificate
Free (pages perso)48F–
WordPress.com38CValid HTTPS certificate, HTTP sends visitors to HTTPS, HSTS for six months or more, CAA record
Blogger24DValid HTTPS certificate, HTTP sends visitors to HTTPS, CAA record
Neopse12EValid HTTPS certificate, HTTP sends visitors to HTTPS
SiteW11CValid HTTPS certificate, HTTP sends visitors to HTTPS, Basic protective headers, DNSSEC
Webnode7EValid HTTPS certificate, HTTP sends visitors to HTTPS
SiteGo5EValid HTTPS certificate, HTTP sends visitors to HTTPS
Orange (pages perso)5FHTTP sends visitors to HTTPS
Weebly5EValid HTTPS certificate, HTTP sends visitors to HTTPS

By département

Aggregates only. Départements with fewer than 10 graded communes (4) show no figures, so that none of them can be singled out.

DépartementCommunesAverageA or BOwn websiteConsumer mailboxDMARC enforced
01 Ain391484.5%75.2%28.8%14.6%
02 Aisne797446.3%24.2%81.9%15.9%
03 Allier3165011.6%60.4%52.1%27.1%
04 Alpes-de-Haute-Provence198453.2%64.6%40.9%19%
05 Hautes-Alpes162486.8%77.2%42.6%16.5%
06 Alpes-Maritimes163474.7%86.5%26.1%16.1%
07 Ardèche335443.1%79.4%32.4%10.4%
08 Ardennes447420%21.5%89.5%13.9%
09 Ariège325442.9%47.4%69%14.9%
10 Aube431400.7%24.1%80.6%9.7%
11 Aude433431.3%49.4%68.1%8.2%
12 Aveyron2856641%76.1%15.4%76.1%
13 Bouches-du-Rhône119556.7%99.2%2.7%28.6%
14 Calvados526476.1%48.7%57.1%19.5%
15 Cantal250432.7%56%75.6%6.8%
16 Charente359534.3%51%52.5%58.5%
17 Charente-Maritime462503.5%61.3%18%5.9%
18 Cher286432.6%60.8%69.4%10.1%
19 Corrèze277473.8%63.5%51.8%14.4%
21 Côte-d'Or698506.8%37.1%80.5%16%
22 Côtes-d'Armor344463.6%75.6%44%9.3%
23 Creuse255400%45.5%81.4%8.7%
24 Dordogne503434.6%59.8%68.7%17.3%
25 Doubs563455.6%41.6%61.5%12.3%
26 Drôme362433.1%66.6%47.8%15.3%
27 Eure585432.4%43.6%72.2%13%
28 Eure-et-Loir363401.2%61.4%59.7%11.1%
29 Finistère2775514.3%93.1%19.5%23.4%
2A Corse-du-Sud124380%47.6%76.9%3.3%
2B Haute-Corse236392.2%39%82.8%8.9%
30 Gard350453%84%36.5%17.8%
31 Haute-Garonne586506.9%58.7%49.5%22.1%
32 Gers4585528.4%26%72.8%45.4%
33 Gironde534474.4%76.8%46.9%13%
34 Hérault341498.4%76.8%33.6%25.2%
35 Ille-et-Vilaine332528.4%93.7%21.5%26.7%
36 Indre241412.6%52.3%61.7%15.9%
37 Indre-et-Loire272463.6%82.4%23.5%11.9%
38 Isère512463.3%86.9%27.1%16.9%
39 Jura492501.8%53.3%53.6%16.1%
40 Landes327593.5%70.6%19.6%74.8%
41 Loir-et-Cher267446.6%66.7%46.4%13.3%
42 Loire320432.4%83.8%27.3%12.3%
43 Haute-Loire2574911%54.5%63.3%14.2%
44 Loire-Atlantique2075918.4%98.6%3.9%35.3%
45 Loiret325486.5%68.3%43.7%21.1%
46 Lot312456.6%63.8%77.9%12.8%
47 Lot-et-Garonne319475.4%55.5%41.1%19.5%
48 Lozère152432.5%48%75.5%12.5%
49 Maine-et-Loire1765211%87.5%20.1%10.4%
50 Manche445454%40.7%64%10.2%
51 Marne610420.8%37%81.8%10.9%
52 Haute-Marne426332.4%16.9%89.1%7.1%
53 Mayenne240465.2%71.3%44.6%15.8%
54 Meurthe-et-Moselle591466.3%34.9%70.1%17.9%
55 Meuse493525.2%19.3%80.5%20%
56 Morbihan2495410.1%92.8%15.7%19%
57 Moselle725422.5%49.8%63.9%11.2%
58 Nièvre309497%44.3%84.4%14%
59 Nord647486.5%79%38%10.4%
60 Oise680475.8%73.4%45.3%22.1%
61 Orne381446.8%27.6%80.1%18.2%
62 Pas-de-Calais887457.2%47.5%57.8%12.3%
63 Puy-de-Dôme463392.4%77.8%63.3%19.2%
64 Pyrénées-Atlantiques545483.3%49%45.5%26.5%
65 Hautes-Pyrénées469401.4%27.1%86.2%16.4%
66 Pyrénées-Orientales226422.2%75.2%46.7%11.5%
67 Bas-Rhin514482.7%72.4%35%14.5%
68 Haut-Rhin366461.7%84.4%18.1%15.7%
69 Rhône266515.3%96.2%3.8%13.4%
70 Haute-Saône536340.5%30.4%83.6%6%
71 Saône-et-Loire563528.6%67.9%57.8%15.8%
72 Sarthe352474%57.4%41.4%10.3%
73 Savoie273462.4%90.1%25.4%18.9%
74 Haute-Savoie279523.7%94.6%8.6%17.6%
75 Paris1–
76 Seine-Maritime707489.4%50.9%54.9%20.5%
77 Seine-et-Marne507487.9%77.9%43.7%20.1%
78 Yvelines259547.9%91.1%22%23.8%
79 Deux-Sèvres252483%60.7%29.6%14.3%
80 Somme771400%54.5%62%2.7%
81 Tarn314443.7%57.3%60.7%14.7%
82 Tarn-et-Garonne1955936.6%66.2%4.7%73%
83 Var153507.4%96.1%16%16.8%
84 Vaucluse151497.4%88.7%23.3%18.5%
85 Vendée253504.9%89.3%7.2%12.7%
86 Vienne265599%68.3%5.3%83.6%
87 Haute-Vienne195454.3%80%49.2%11.6%
88 Vosges506431.8%28.3%78.5%15.2%
89 Yonne423507.5%57%74.5%18.7%
90 Territoire de Belfort101420%61.4%61.6%11.6%
91 Essonne1945412.2%90.2%19.3%26.7%
92 Hauts-de-Seine366622.2%100%3.7%30.6%
93 Seine-Saint-Denis396020.5%100%0%46.2%
94 Val-de-Marne476422.2%97.9%0%31.1%
95 Val-d'Oise1835411.3%87.4%27.3%20.8%
971 Guadeloupe32533.3%90.6%10%13.3%
972 Martinique34453.2%73.5%9.1%12.9%
973 Guyane22506.3%45.5%25%31.3%
974 La Réunion245712.5%100%0%45.8%
975 Saint-Pierre-et-Miquelon2–
976 Mayotte17430%70.6%0%7.1%
977 Saint-Barthélemy1–
978 Saint-Martin1–
987 Polynésie française41523.6%26.8%13.2%53.6%
988 Nouvelle-Calédonie33470%27.3%20%16%

Behind the numbers

Consumer mailboxes used by town halls

  • wanadoo.fr49.3%
  • orange.fr40.2%
  • gmail.com5.9%
  • laposte.net1.5%
  • outlook.fr0.6%
  • free.fr0.4%

Who issues the certificates of the communes’ own sites

  • Let's Encrypt77.1%
  • Google Trust Services4.4%
  • ZeroSSL GmbH3.9%
  • Sectigo Limited3.7%
  • Gandi1.1%
  • DigiCert Inc1%

What the communes’ own sites run on (when the page says so)

  • WordPress44.9%
  • Not stated35.3%
  • Other14.7%
  • Joomla2%
  • Drupal1.6%
  • Wix1.5%

Registrars of the communes’ domains

  • OVH61.4%
  • GANDI14.3%
  • REGIE AUTONOME DE NUMERIAN6.3%
  • IONOS5.3%
  • SCALEWAY5.3%
  • NORDNET2.5%
  • NAMESHIELD2.5%
  • SOMME NUMERIQUE2.4%

Serious issues are reported privately

276 communes have a serious issue. They are not named here: we tell them first, quietly.

  • Website or mail domains listed in the official directory that no longer exist, which anyone could register: 134
  • Domains registered but missing from DNS: 24
  • Domains missing from DNS, registration to check: 3
  • Domains whose DNS answers fail: 27
  • Expired certificates: 52
  • SPF records that let anyone send mail in the town hall’s name: 37

How we measured

Passive checks only: the home page of each website over HTTP and HTTPS and nothing else on the site, public DNS records, a robot that says who it is. Sources: the official directory of the administration (Service-Public.fr, DILA, Licence Ouverte 2.0) and the population figures of the State’s geographic API.

Read the methodology Download the figures (JSON) Download the full report (PDF)

Figures corrected on 8 November 2026: see the methodology.

Next edition: January 2027, then every quarter. You may reuse these figures with a link to this page.