Perimetry Research · November 2026 edition
How well do French universities and grandes écoles protect their website and e-mail?
We measured the website and its domain for every establishment in the ministry’s list of the main French higher education establishments: 245 universities and schools, public (160) and private (85), 229 domains, with the same passive checks as our studies of the communes and the local authorities and as Perimetry Cloud. Here is what we found, how they compare, and who gets it right.
Download the full report (PDF) Findings, charts, every table, the comparison with the communes and the local authorities, recommendations and the methodology.
- 245
- establishments studied
- 64
- average score out of 100
- 45.4%
- enforce DMARC (quarantine or reject)
- 32.3%
- get an A or a B
What stands out
86.9% of the graded establishments publish a DMARC policy, but 45.4% enforce it. Without an enforced policy, a message forged in an establishment’s name, to its students or staff, is generally delivered.
Websites: 100% have a valid certificate and 95.2% send visitors from HTTP to HTTPS; 46.1% use HSTS for six months or more.
12.7% of their domains are signed with DNSSEC and 41% publish a CAA record.
The public establishments average 65 out of 100, the private ones 63.
The universities average 67 out of 100 (on nine checks); the communes 47, the local authorities 60.
Grades
Each establishment whose website is on a domain of its own gets a score: the share of the nine checks below that it passes, among those that apply to it (the score of the communes and local authorities studies, without the check on the contact address, which the ministry’s list does not give). 229 are graded; the average is 64 out of 100.
A: 90 or more · B: 75 · C: 60 · D: 40 · E: 20 · F: under 20
By category
Categories with fewer than ten graded establishments show no figures, so that none of them can be singled out.
| Category | Establishments | Graded | Average | A or B | Own domain | DMARC enforced | Median |
|---|---|---|---|---|---|---|---|
| Universities (and assimilated establishments) | 70 | 70 | 67 | 37.1% | 100% | 37.1% | 67 |
| Grands établissements | 21 | 21 | 63 | 23.8% | 100% | 42.9% | – |
| Public engineering schools | 25 | 22 | 69 | 59.1% | 88% | 45.5% | – |
| Public schools of art, architecture and culture | 26 | 19 | 57 | 21.1% | 73.1% | 26.3% | – |
| Other public establishments | 18 | 15 | 62 | 40% | 83.3% | 40% | – |
| Business and management schools (private) | 24 | 24 | 67 | 29.2% | 100% | 62.5% | – |
| Private engineering schools | 46 | 43 | 62 | 25.6% | 93.5% | 58.1% | 56 |
| Other private establishments | 15 | 15 | 59 | 13.3% | 100% | 53.3% | – |
9 establishments have their website on another organisation’s domain (a university they belong to, a parent body, a group of schools): they are counted, not graded.
Public and private
The two sectors of the ministry’s list.
| Sector | Establishments | Graded | Average | A or B | Own domain | DMARC enforced | Median |
|---|---|---|---|---|---|---|---|
| Public sector | 160 | 147 | 65 | 36.7% | 91.9% | 38.1% | 67 |
| Private sector | 85 | 82 | 63 | 24.4% | 96.5% | 58.5% | 67 |
Check by check
Share of the graded establishments that pass each check, among those it applies to. The e-mail checks are made on the website’s domain.
Website
- Valid HTTPS certificate100%
The site answers over HTTPS with a certificate that is in date, issued for its name, and trusted by browsers. 228 of 228.
- HTTP sends visitors to HTTPS95.2%
Someone who types the address lands on the encrypted site, not on a page anyone on the network can read or alter. 217 of 228.
- HSTS for six months or more46.1%
Browsers remember to use HTTPS only, so the first unencrypted request cannot be hijacked. 105 of 228.
- Basic protective headers57.5%
X-Content-Type-Options: nosniff, and protection against being framed by another site (X-Frame-Options or CSP frame-ancestors). 131 of 228.
DNS
- DNSSEC12.7%
Answers about the domain are signed, so a resolver cannot be fed false addresses for the establishment’s site or mail. 29 of 229.
- CAA record41%
The domain names the certificate authorities allowed to issue certificates for it. 94 of 229.
- Strict SPF93%
The domain lists the servers allowed to send its mail and asks receivers to reject or flag the others (-all or ~all). 213 of 229.
- DMARC record86.9%
The domain publishes a DMARC policy, the standard that ties SPF and DKIM to the visible sender. 199 of 229.
- DMARC enforced45.4%
The policy is quarantine or reject: messages forged in the establishment’s name, to its students for example, go to spam or are refused, not delivered. 104 of 229.
Compared with the communes and the local authorities
The same checks as our studies of the French communes and local authorities (latest editions): share of the graded bodies that pass each one.
| Communes | Local authorities | Universities (on nine checks) | Public sector (on nine checks) | Private sector (on nine checks) | |
|---|---|---|---|---|---|
| Average score | 47 | 60 | 67 | 65 | 63 |
| Valid HTTPS certificate | 93.4% | 98.7% | 100% | 100% | 100% |
| HTTP sends visitors to HTTPS | 86.4% | 90.9% | 98.6% | 97.3% | 91.5% |
| HSTS for six months or more | 28.3% | 38.8% | 49.3% | 47.9% | 42.7% |
| Basic protective headers | 26.1% | 40.7% | 62.3% | 61% | 51.2% |
| DNSSEC | 22.1% | 25.9% | 10% | 10.2% | 17.1% |
| CAA record | 2.8% | 2.6% | 62.9% | 51% | 23.2% |
| Strict SPF | 85.9% | 97.1% | 91.4% | 90.5% | 97.6% |
| DMARC record | 45.2% | 77.8% | 90% | 87.8% | 85.4% |
| DMARC enforced | 19.2% | 32.8% | 37.1% | 38.1% | 58.5% |
Honour roll
7 establishments pass every one of the nine checks.
- Université de Montpellier (University)
- Université Le Havre Normandie (University)
- Université Lumière - Lyon 2 (University)
- Centrale Méditerranée (Public engineering school)
- Université de technologie de Compiègne (Public engineering school)
- École nationale vétérinaire d'Alfort (Other public)
- École supérieure angevine en informatique et productique (Private engineering school)
Best in each category
The highest scores among the graded establishments (at least eight checks applying, 75 or more), up to ten per category. Only in categories of thirty graded establishments or more: in a smaller one, naming the best would tell where the others stand, so only its honour roll is named.
Universities (and assimilated establishments)
- Université de Montpellier100
- Université Lumière - Lyon 2100
- Université Le Havre Normandie100
- Université Toulouse - Jean Jaurès89
- Université Paris 889
- Université de Lille78
- Aix-Marseille Université78
- Lyon-I université78
- Université Paris 1 - Panthéon Sorbonne78
- Université de Caen Normandie78
Private engineering schools
- École supérieure angevine en informatique et productique100
- École supérieure d'informatique électronique automatique89
- École de biologie industrielle89
- École supérieure d'ingénieurs des travaux de la construction de Paris89
- École catholique des arts et métiers89
- Institut polytechnique UniLaSalle78
- École supérieure de chimie physique électronique de Lyon78
- Institut supérieur d'électronique de Paris78
- École supérieure des technologies industrielles avancées78
- École supérieure d’agriculture d'Angers78
By region
Aggregates only. Regions with fewer than ten graded establishments (10) show no figures.
| Region | Establishments | Graded | Average | A or B | Own domain | DMARC enforced |
|---|---|---|---|---|---|---|
| Auvergne-Rhône-Alpes | 21 | 20 | 69 | 50% | 95.2% | 25% |
| Bourgogne-Franche-Comté | 4 | 4 | – | |||
| Bretagne | 11 | 10 | 58 | 0% | 90.9% | 20% |
| Centre-Val de Loire | 3 | 3 | – | |||
| Collectivités d'outre-mer | 2 | 2 | – | |||
| Corse | 1 | 1 | – | |||
| Grand Est | 17 | 15 | 54 | 13.3% | 88.2% | 6.7% |
| Guadeloupe | 1 | 1 | – | |||
| Guyane | 1 | 1 | – | |||
| Hauts-de-France | 17 | 15 | 70 | 46.7% | 88.2% | 66.7% |
| Île-de-France | 85 | 80 | 63 | 28.8% | 94.1% | 46.3% |
| La Réunion | 1 | 1 | – | |||
| Mayotte | 1 | 1 | – | |||
| Normandie | 13 | 13 | 69 | 46.2% | 100% | 61.5% |
| Nouvelle-Aquitaine | 16 | 16 | 68 | 43.8% | 100% | 50% |
| Occitanie | 23 | 20 | 67 | 40% | 87% | 60% |
| Pays de la Loire | 15 | 14 | 71 | 42.9% | 93.3% | 71.4% |
| Provence-Alpes-Côte d'Azur | 9 | 9 | – | |||
| Abroad | 4 | 3 | – | |||
Behind the numbers
98.3% of the graded domains receive mail themselves (an MX record): the domain whose SPF and DMARC are read is then the one the establishment writes from.
Who issues the certificates of their sites
- Hellenic Academic and Research Institutions CA48.5%
- Let's Encrypt34.1%
- Google Trust Services5.2%
- Sectigo Limited3.9%
What their sites run on (when the page says so)
- WordPress42.4%
- Drupal21.4%
- Other21%
- Not stated15.3%
Registrars of their domains
- GIP RENATER58.3%
- OVH20.3%
- GANDI16%
- NAMESHIELD2.7%
- SCALEWAY2.7%
Serious issues are reported privately
No establishment has a serious issue in this edition.
How we measured
Passive checks only, the communes study’s: the home page of each website over HTTP and HTTPS and nothing else on the site, public DNS records, a robot that says who it is. Source: the list of the main higher education establishments of the ministry of Higher Education and Research (data.enseignementsup-recherche.gouv.fr, Licence Ouverte 2.0), with Wikidata (CC0) for a website the list lacks.
Read the methodology Download the figures (JSON) Download the full report (PDF)
Next edition: March 2027, then every quarter. You may reuse these figures with a link to this page.