Perimetry Research · November 2026 edition
How well does the French State protect its websites and e-mail?
We measured the 1,440 domains of the State in two open lists, the DINUM’s and that of the observatory of the State’s digital ecosystem: prefectures, ministries, académies, embassies, government sites. 1,069 are active; the 660 with a site of their own are graded, with the same passive checks as our other studies and as Perimetry Cloud, and the 409 without one are shown apart. Here is what we found, and who gets it right.
Download the full report (PDF) Findings, charts, every table, the comparison with the other studies, recommendations and the methodology.
- 660
- domains with a site of their own, graded
- 46
- average score out of 100
- 43.3%
- enforce DMARC (quarantine or reject)
- 13%
- get an A or a B
What stands out
56.7% of the graded domains publish a DMARC policy and 43.3% enforce it. For the others, an e-mail forged in the administration’s name, to citizens or to other administrations, is generally delivered.
Websites: 63.8% have a valid certificate and 77.3% send visitors from HTTP to HTTPS; 33.3% use HSTS for six months or more and 51.9% send the basic protective headers.
DNSSEC is rare: 3.8% of the State’s graded domains are signed, against 22.1% of the communes’. 18.5% publish a CAA record.
The prefectures, whose settings are almost all the same, average 67: all of them enforce DMARC, but none uses HSTS, so none reaches an A or a B.
409 active domains have no site of their own: 159 send visitors to another site, 250 are used for mail only. 63.3% of them do not enforce DMARC: e-mail forged in their name is delivered.
18.5% of the State’s active domains are outside .gouv.fr, the extension reserved for the State.
Grades
Each domain with a site of its own gets a score: the share of the nine checks below that it passes, among those that apply to it (the score of our other studies, without the check on the contact address, which the lists do not give). 660 domains are graded; the average is 46 out of 100, the median 44.
A: 90 or more · B: 75 · C: 60 · D: 40 · E: 20 · F: under 20
371 of the 1,440 listed domains are inactive (13 no longer in DNS, 358 with neither a site in use nor a mail server) and left out.
Check by check
Share of the graded domains that pass each check, among those it applies to.
Website
- Valid HTTPS certificate63.8%
The site answers over HTTPS with a certificate that is in date, issued for its name, and trusted by browsers. 421 of 660.
- HTTP sends visitors to HTTPS77.3%
Someone who types the address lands on the encrypted site, not on a page anyone on the network can read or alter. 510 of 660.
- HSTS for six months or more33.3%
Browsers remember to use HTTPS only, so the first unencrypted request cannot be hijacked. 180 of 541.
- Basic protective headers51.9%
X-Content-Type-Options: nosniff, and protection against being framed by another site (X-Frame-Options or CSP frame-ancestors). 281 of 541.
DNS
- DNSSEC3.8%
Answers about the domain are signed, so a resolver cannot be fed false addresses for the administration’s site or mail. 25 of 660.
- CAA record18.5%
The domain names the certificate authorities allowed to issue certificates for it. 122 of 660.
- Strict SPF56.2%
The domain lists the servers allowed to send its mail and asks receivers to reject or flag the others (-all or ~all). 371 of 660.
- DMARC record56.7%
The domain publishes a DMARC policy, the standard that ties SPF and DKIM to the visible sender. 374 of 660.
- DMARC enforced43.3%
The policy is quarantine or reject: messages forged in the administration’s name, to citizens for example, go to spam or are refused, not delivered. 286 of 660.
By category
Categories with fewer than ten graded domains show no figures, so that none of them can be singled out. Most embassy domains send visitors to a site on another domain: they are counted among the domains without a site of their own.
| Group | Graded | Average | A or B | DMARC enforced | Median |
|---|---|---|---|---|---|
| Prefectures | 94 | 67 | 0% | 100% | 71 |
| Education authorities (académies) | 34 | 65 | 29.4% | 32.4% | 67 |
| Embassies | 2 | – | |||
| Ministries | 14 | 56 | 14.3% | 14.3% | – |
| Health agencies | 2 | – | |||
| Other government domains (DINUM list) | 465 | 39 | 14.4% | 36.1% | 44 |
| Other sites of the observatory of the State’s digital ecosystem | 49 | 49 | 12.2% | 18.4% | 44 |
By kind of site
The observatory’s kinds of site, for the domains it lists.
| Group | Graded | Average | A or B | DMARC enforced | Median |
|---|---|---|---|---|---|
| Institutional sites | 175 | 65 | 13.1% | 74.9% | 71 |
| Online procedures | 21 | 65 | 52.4% | 57.1% | – |
| Thematic sites | 51 | 53 | 17.6% | 31.4% | 56 |
| Other (open data, recruitment, events…) | 34 | 56 | 23.5% | 29.4% | 56 |
Domains without a site of their own
A domain that only sends visitors elsewhere, or that is only used for mail, can still be used to forge e-mail in the State’s name. These 409 domains are judged on DNS and mail only.
- 409
- domains (159 send visitors to another site, 250 mail only)
- 63.3%
- do not enforce DMARC
- 43.3%
- DMARC record
- 28
- average score (DNS and mail only)
The State’s own indicators
- 18.5%
- of the active domains outside .gouv.fr
- 0.9%
- of the listed domains no longer in DNS
Compared with the other studies
The same checks in our studies of the communes, local authorities, higher education and .fr domains (latest editions): share of the graded domains that pass each one. The communes and local authorities count ten checks, the others nine.
| The State (9 checks) | Communes (10 checks) | Local authorities (10 checks) | Higher education (9 checks) | .fr domains (9 checks) | |
|---|---|---|---|---|---|
| Average score | 46 | 47 | 60 | 64 | 32 |
| Valid HTTPS certificate | 63.8% | 93.4% | 98.7% | 100% | 59.1% |
| HTTP sends visitors to HTTPS | 77.3% | 86.4% | 90.9% | 95.2% | 53.4% |
| HSTS for six months or more | 33.3% | 28.3% | 38.8% | 46.1% | 17.3% |
| Basic protective headers | 51.9% | 26.1% | 40.7% | 57.5% | 14.1% |
| DNSSEC | 3.8% | 22.1% | 25.9% | 12.7% | 25.9% |
| CAA record | 18.5% | 2.8% | 2.6% | 41% | 1.2% |
| Strict SPF | 56.2% | 85.9% | 97.1% | 93% | 71.6% |
| DMARC record | 56.7% | 45.2% | 77.8% | 86.9% | 38.6% |
| DMARC enforced | 43.3% | 19.2% | 32.8% | 45.4% | 11.7% |
Honour roll
3 domains pass every one of the nine checks and have no serious issue.
- douane.gouv.fr (Other government domains (DINUM list))
- info.gouv.fr (Other government domains (DINUM list))
- secnumacademie.gouv.fr (Other government domains (DINUM list))
Serious issues were reported privately
78 domains have a serious issue. They are not named here: we reported them to the CERT-FR of the ANSSI before publishing.
- Expired certificates: 65
- Domains whose DNS answers fail: 13
How we measured
Passive checks only: the home page of each site over HTTP and HTTPS and nothing else on it, public DNS records, a robot that says who it is. Sources: the DINUM’s list of the domain names of public bodies and the list of sites of the observatory of the State’s digital ecosystem (Service d’information du Gouvernement), both under the Licence Ouverte 2.0.
Read the methodology Download the figures (JSON) Download the full report (PDF)
You may reuse these figures with a link to this page.