Perimetry Research · November 2026 edition
How well do French intercommunalities, départements and regions protect their website and e-mail?
We measured the website and e-mail domain of every intercommunality, département and region listed in the official directory of the French administration: 1,382 local authorities, 1,668 domains, with the same passive checks as the communes study and Perimetry Cloud. Here is what we found, how they compare with the communes, and who gets it right.
Download the full report (PDF) Findings, charts, every table, the comparison with the communes, recommendations and the methodology.
- 1,382
- local authorities studied
- 60
- average score out of 100
- 32.8%
- enforce DMARC (quarantine or reject)
- 15.5%
- get an A or a B
What stands out
77.8% of the graded local authorities publish a DMARC policy, but 32.8% enforce it. Without an enforced policy, a message forged in an authority’s name is generally delivered.
Websites: 98.7% have a valid certificate and 90.9% send visitors from HTTP to HTTPS; 38.8% use HSTS for six months or more.
25.9% of their domains are signed with DNSSEC and 2.6% publish a CAA record.
The intercommunalities average 60 out of 100, the communes 47.
1.2% of the town halls write from, or publish on, their intercommunality’s own domain: when it is well protected, so are they.
Grades
Each authority with a domain of its own gets a score: the share of the ten checks below that it passes, among those that apply to it (the communes study’s score). 1,372 are graded; the average is 60 out of 100.
A: 90 or more · B: 75 · C: 60 · D: 40 · E: 20 · F: under 20
By category
Categories with fewer than ten graded authorities show no figures, so that none of them can be singled out.
| Category | Authorities | Graded | Average | A or B | Own website | DMARC enforced | Median |
|---|---|---|---|---|---|---|---|
| Metropolises (métropoles) | 21 | 21 | 68 | 33.3% | 100% | 38.1% | – |
| Urban communities | 14 | 14 | 58 | 7.1% | 100% | 28.6% | – |
| Agglomeration communities | 229 | 226 | 64 | 23.9% | 98.3% | 42.9% | 60 |
| Communities of communes | 988 | 983 | 59 | 11.9% | 99% | 29.1% | 60 |
| Territorial public establishments (Greater Paris) | 11 | 9 | – | ||||
| Départements | 93 | 93 | 63 | 24.7% | 100% | 44.1% | 60 |
| Regions | 14 | 14 | 71 | 50% | 100% | 57.1% | – |
| Authorities with a special status | 7 | 7 | – | ||||
| Overseas collectivities | 5 | 5 | – | ||||
Check by check
Share of the graded authorities that pass each check, among those it applies to.
Website
- Valid HTTPS certificate98.7%
The site answers over HTTPS with a certificate that is in date, issued for its name, and trusted by browsers. 1,336 of 1,353.
- HTTP sends visitors to HTTPS90.9%
Someone who types the address lands on the encrypted site, not on a page anyone on the network can read or alter. 1,230 of 1,353.
- HSTS for six months or more38.8%
Browsers remember to use HTTPS only, so the first unencrypted request cannot be hijacked. 519 of 1,339.
- Basic protective headers40.7%
X-Content-Type-Options: nosniff, and protection against being framed by another site (X-Frame-Options or CSP frame-ancestors). 545 of 1,339.
DNS
- DNSSEC25.9%
Answers about the domain are signed, so a resolver cannot be fed false addresses for the authority’s site or mail. 355 of 1,372.
- CAA record2.6%
The domain names the certificate authorities allowed to issue certificates for it. 36 of 1,372.
- Strict SPF97.1%
The domain lists the servers allowed to send its mail and asks receivers to reject or flag the others (-all or ~all). 1,327 of 1,367.
- DMARC record77.8%
The domain publishes a DMARC policy, the standard that ties SPF and DKIM to the visible sender. 1,063 of 1,367.
- DMARC enforced32.8%
The policy is quarantine or reject: messages forged in the authority’s name go to spam or are refused, not delivered. 448 of 1,367.
- Address on a public domain98.3%
The address in the directory is on the authority’s own domain or a shared public one, not on a consumer mailbox (Orange, Gmail…) it does not control. 1,252 of 1,274.
Compared with the communes
The same ten checks as the study of the French communes (edition of November 2026): share of the graded bodies that pass each one.
| Communes | Intercommunalities | Départements | Regions | |
|---|---|---|---|---|
| Average score | 47 | 60 | 63 | 71 |
| Valid HTTPS certificate | 93.4% | 98.7% | 98.9% | 100% |
| HTTP sends visitors to HTTPS | 86.4% | 90.9% | 90.8% | 85.7% |
| HSTS for six months or more | 28.3% | 37.9% | 43.7% | 71.4% |
| Basic protective headers | 26.1% | 38.6% | 58.6% | 78.6% |
| DNSSEC | 22.1% | 26.8% | 18.3% | 14.3% |
| CAA record | 2.8% | 1.8% | 7.5% | 35.7% |
| Strict SPF | 85.9% | 97.1% | 98.9% | 92.9% |
| DMARC record | 45.2% | 76.4% | 92.5% | 100% |
| DMARC enforced | 19.2% | 31.7% | 44.1% | 57.1% |
| Address on a public domain | 71.1% | 98.3% | 100% | 100% |
Intercommunalities by population
The four categories of intercommunality together, by number of inhabitants.
| Population | Authorities | Graded | Average | A or B | Own website | DMARC enforced | Median |
|---|---|---|---|---|---|---|---|
| 200,000 inhabitants or more | 49 | 49 | 67 | 34.7% | 100% | 46.9% | 67 |
| 50,000 to 199,999 | 234 | 231 | 64 | 21.6% | 98.3% | 40.6% | 60 |
| 20,000 to 49,999 | 443 | 441 | 61 | 15.4% | 98.9% | 35.4% | 60 |
| Under 20,000 | 526 | 523 | 56 | 8.4% | 99% | 23.2% | 60 |
Shared domains
Many intercommunalities run the website or the e-mail of their member communes on their own domain. 1.2% of the town halls listed in the directory write from, or publish on, their intercommunality’s domain, and 10.9% of the intercommunalities with a domain serve at least one member town hall that way. Their protection is shared too.
10 intercommunalities have no site of their own: their website is a page of a member town’s site. They are counted, not graded.
Honour roll
2 local authorities pass every one of the ten checks.
- Caux Seine Agglo (Agglomerations)
- Conseil départemental – Orne (Départements)
Is your organisation in this study?
Ask for its private page: its score, the checks of the study and where it stands among comparable organisations. The link is sent only to an address on your organisation’s domain; nothing else follows.
Best in each category
The highest scores among authorities with their own website (at least nine checks applying, 75 or more), up to ten per category. Only in categories of thirty graded authorities or more: in a smaller one, naming the best would tell where the others stand, so only its honour roll is named.
Agglomeration communities
- Caux Seine Agglo100
- Communauté d’agglomération Saint Germain Boucles de Seine90
- Communauté Paris-Saclay90
- Douaisis Agglo90
- Communauté d’agglomération Maubeuge Val de Sambre90
- Lannion-Trégor Communauté90
- Communauté d’agglomération du Grand Chambéry89
- Communauté d’agglomération du Pays Basque80
- Communauté d’agglomération Val Parisis80
- Communauté d’agglomération de Béthune-Bruay, Artois-Lys Romane80
Communities of communes
- Communauté de communes Auray Quiberon Terre Atlantique90
- Intercom Bernay Terres de Normandie90
- Ploërmel Communauté90
- Communauté de communes du Pays des Abers90
- Communauté de communes du Ternois90
- Communauté de communes du Grand Autunois Morvan90
- Communauté de communes des Grands Lacs90
- Bretagne Porte de Loire Communauté90
- Communauté de communes du Volvestre90
- Communauté de communes du Pays Haut Val d'Alzette90
Départements
- Conseil départemental – Orne100
- Conseil départemental – Charente-Maritime90
- Conseil départemental – Nord89
- Conseil départemental – Manche89
- Conseil départemental – Gironde80
- Conseil départemental – Hauts-de-Seine80
- Conseil départemental – Yvelines80
- Conseil départemental – Haute-Garonne80
- Conseil départemental – Pas-de-Calais80
- Conseil départemental – Finistère80
Intercommunalities by region
Aggregates only. Regions with fewer than ten graded intercommunalities (5) show no figures.
| Region | Authorities | Graded | Average | A or B | Own website | DMARC enforced |
|---|---|---|---|---|---|---|
| Guadeloupe | 6 | 6 | – | |||
| Martinique | 3 | 3 | – | |||
| Guyane | 4 | 4 | – | |||
| La Réunion | 5 | 5 | – | |||
| Mayotte | 5 | 4 | – | |||
| Île-de-France | 52 | 52 | 65 | 28.8% | 100% | 44.2% |
| Centre-Val de Loire | 81 | 80 | 57 | 6.3% | 98.8% | 21.3% |
| Bourgogne-Franche-Comté | 114 | 114 | 56 | 6.1% | 100% | 23.7% |
| Normandie | 69 | 67 | 64 | 22.4% | 95.7% | 35.8% |
| Hauts-de-France | 90 | 90 | 60 | 18.9% | 98.9% | 27% |
| Grand Est | 148 | 148 | 56 | 6.8% | 98.6% | 28.4% |
| Pays de la Loire | 69 | 69 | 64 | 20.3% | 98.6% | 26.1% |
| Bretagne | 59 | 58 | 69 | 34.5% | 98.3% | 47.4% |
| Nouvelle-Aquitaine | 156 | 156 | 58 | 9% | 100% | 30.8% |
| Occitanie | 159 | 157 | 60 | 15.9% | 98.7% | 39.7% |
| Auvergne-Rhône-Alpes | 167 | 166 | 61 | 14.5% | 99.4% | 32.5% |
| Provence-Alpes-Côte d'Azur | 46 | 46 | 60 | 17.4% | 100% | 41.3% |
| Corse | 19 | 19 | 48 | 0% | 100% | 15.8% |
Behind the numbers
Who issues the certificates of their own sites
- Let's Encrypt77.7%
- Sectigo Limited6.1%
- Google Trust Services3.5%
- DigiCert Inc2.4%
- Gandi SAS2.3%
- ZeroSSL GmbH1.5%
What their own sites run on (when the page says so)
- WordPress53.4%
- Not stated27.3%
- Other10.6%
- Drupal6.1%
- Joomla1.9%
- Wix0.7%
Registrars of their domains
- OVH66.1%
- GANDI15%
- ORANGE BUSINESS SERVICES SA, DIRECTION EOLAS4%
- IONOS3.7%
- SCALEWAY3.6%
- AMEN / AGENCE DES MÉDIAS NUMÉRIQUES2.7%
- NAMESHIELD2.7%
- ADISTA2.1%
Consumer mailboxes in the directory
- orange.fr63.6%
- wanadoo.fr22.7%
Serious issues are reported privately
7 local authorities have a serious issue. They are not named here: we tell them first, quietly.
- Domains listed in the official directory that no longer exist, which anyone could register: 4
- Domains missing from DNS, registration to check: 1
- Expired certificates: 2
How we measured
Passive checks only, the communes study’s: the home page of each website over HTTP and HTTPS and nothing else on the site, public DNS records, a robot that says who it is. Sources: the official directory of the administration (Service-Public.fr, DILA, Licence Ouverte 2.0) and the State’s geographic API (official list of intercommunalities, populations).
Read the methodology Download the figures (JSON) Download the full report (PDF)
Next edition: February 2027, then every quarter. You may reuse these figures with a link to this page.