Perimetry Research · November 2026 edition
How well do Germany’s local authorities protect their websites and e-mail?
We measured the websites and e-mail of Germany’s 411 Landkreise, kreisfreie Städte and Länder, the level that matches the French départements, large intercommunalities and regions. 387 have a site of their own and are graded, with the same passive checks as our French studies and as Perimetry Cloud. Parish-level municipalities (Gemeinden) are left for a later study.
Download the full report (PDF) Findings, charts, every table, the comparison with our other studies, recommendations and the methodology.
- 387
- domains with a site of their own, graded
- 62
- average score out of 100
- 41.1%
- enforce DMARC (quarantine or reject)
- 32.3%
- get an A or a B
What stands out
73.6% of the graded domains publish a DMARC policy and 41.1% enforce it (French local authorities: 32.8%; UK councils: 95.5%). Where it is not enforced, an e-mail forged in the authority’s name, to residents for example, is generally delivered.
Websites: 96.4% have a valid certificate and 92% send visitors from HTTP to HTTPS; 74.3% use HSTS for six months or more and 68.6% send the basic protective headers.
15% of the graded domains are signed with DNSSEC; 12.4% publish a CAA record.
The comparison with the French local authorities, check by check and level by level, is on its own page.
23 active domains have no site of their own (13 send visitors to another site, 10 are used for mail only); they are judged on DNS and mail only and left out of the grades.
Grades
Each domain with a site of its own gets a score: the share of the nine checks below that it passes, among those that apply to it. 387 domains are graded; the average is 62 out of 100, the median 67.
A: 90 or more · B: 75 · C: 60 · D: 40 · E: 20 · F: under 20
When a site answers our robot with an error page (often a filter that turns away data-centre networks), its certificate and its HTTP redirect are still graded, but not its headers, which would be the filter’s.
Check by check
Share of the graded domains that pass each check, among those it applies to.
Website
- Valid HTTPS certificate96.4%
The site answers over HTTPS with a certificate that is in date, issued for its name, and trusted by browsers. 373 of 387.
- HTTP sends visitors to HTTPS92%
Someone who types the address lands on the encrypted site, not on a page anyone on the network can read or alter. 356 of 387.
- HSTS for six months or more74.3%
Browsers remember to use HTTPS only, so the first unencrypted request cannot be hijacked. 272 of 366.
- Basic protective headers68.6%
X-Content-Type-Options: nosniff, and protection against being framed by another site (X-Frame-Options or CSP frame-ancestors). 251 of 366.
DNS
- DNSSEC15%
Answers about the domain are signed, so a resolver cannot be fed false addresses for the administration’s site or mail. 58 of 387.
- CAA record12.4%
The domain names the certificate authorities allowed to issue certificates for it. 48 of 387.
- Strict SPF88.6%
The domain lists the servers allowed to send its mail and asks receivers to reject or flag the others (-all or ~all). 343 of 387.
- DMARC record73.6%
The domain publishes a DMARC policy, the standard that ties SPF and DKIM to the visible sender. 285 of 387.
- DMARC enforced41.1%
The policy is quarantine or reject: messages forged in the administration’s name, to citizens for example, go to spam or are refused, not delivered. 159 of 387.
By category
Categories with fewer than ten graded domains show no figures, so that none can be singled out.
| Group | Graded | Average | A or B | DMARC enforced | Median |
|---|---|---|---|---|---|
| Landkreise (rural districts) | 274 | 62 | 31.8% | 40.1% | 67 |
| Kreisfreie Städte (district-free cities) | 100 | 63 | 31% | 44% | 67 |
| Länder (federal states) | 13 | 71 | 53.8% | 38.5% | – |
Compared with our other studies
The same checks in our other studies (latest editions): share of the graded domains that pass each one. The French local authorities count ten checks, the others nine.
| German local authorities (9 checks) | UK councils (9 checks) | French local authorities (10 checks) | French State (9 checks) | |
|---|---|---|---|---|
| Average score | 62 | 69 | 60 | 46 |
| Valid HTTPS certificate | 96.4% | 98.1% | 98.7% | 63.8% |
| HTTP sends visitors to HTTPS | 92% | 85.5% | 90.9% | 77.3% |
| HSTS for six months or more | 74.3% | 57% | 38.8% | 33.3% |
| Basic protective headers | 68.6% | 74.3% | 40.7% | 51.9% |
| DNSSEC | 15% | 1.9% | 25.9% | 3.8% |
| CAA record | 12.4% | 11.4% | 2.6% | 18.5% |
| Strict SPF | 88.6% | 100% | 97.1% | 56.2% |
| DMARC record | 73.6% | 99.4% | 77.8% | 56.7% |
| DMARC enforced | 41.1% | 95.5% | 32.8% | 43.3% |
Honour roll
7 authorities pass every one of the nine checks and have no serious issue.
- Bayern (Länder (federal states))
- Hamburg (Länder (federal states))
- Landkreis Haßberge (Landkreise (rural districts))
- Heilbronn (Kreisfreie Städte (district-free cities))
- Ingolstadt (Kreisfreie Städte (district-free cities))
- Kreis Plön (Landkreise (rural districts))
- Landkreis Teltow-Fläming (Landkreise (rural districts))
Is your organisation in this study?
Ask for its private page: its score, the checks of the study and where it stands among comparable organisations. The link is sent only to an address on your organisation’s domain; nothing else follows.
Serious issues were reported privately
1 domain has a serious issue. It is not named here: we told the authority privately before publishing.
- Expired certificates: 1
How we measured
Passive checks only: the home page of each site over HTTP and HTTPS and nothing else on it, public DNS records, a robot that says who it is. Source: Wikidata (CC0) for the list, the official key (AGS) and each authority’s official website.
Read the methodology Download the figures (JSON) Download the full report (PDF)
You may reuse these figures with a link to this page. List from Wikidata (CC0).