# Email security for local government: a practical guide for municipalities

URL: https://iblockspam.com/blog/email-security-for-local-government
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Choosing a filter
Author: iBlockSpam Team

> Email security for cities, counties and towns: free .gov domains, DMARC, ransomware and vendor payment fraud, free CISA and CIS resources, and a checklist.

## Short answer

Local governments should move email to a free .gov domain, publish SPF, DKIM and DMARC at p=reject, and enforce MFA on every mailbox. Verify vendor bank changes by phone, filter inbound mail, keep offline backups, and use free CISA Cyber Hygiene scanning. BOD 18-01 binds only federal executive branch agencies, but its email steps are a sound model.

Cities, counties, towns and special districts run email on tight budgets, often with one IT person or an outside provider. Yet they move large sums to vendors, hold records about residents, and run services people depend on. Attackers know this. This guide covers the email risks that matter most for local government, the free .gov domain program, DMARC and the federal directive people often ask about, and the free resources still available after 2025's funding changes.

## What email threats do local governments face?

Three threats cause most of the damage.

| Threat | Typical start | Impact |
| --- | --- | --- |
| Ransomware | Phishing link, malicious attachment or stolen password | Services offline, data stolen, long recovery |
| Vendor payment fraud | Fake or hijacked contractor email with "new bank details" | Large payments sent to criminals |
| Account takeover | Fake sign-in page for the town's Microsoft 365 or Google Workspace | Access to resident data and trusted outgoing mail |

### Ransomware

CISA's [#StopRansomware Guide](https://www.cisa.gov/resources-tools/resources/stopransomware-guide), written with the FBI, NSA and MS-ISAC, treats phishing as one of the main initial access routes. Email delivers malware loaders and captures passwords; attackers then spread through the network before encrypting anything. Our guide to [how ransomware arrives by email](https://iblockspam.com/blog/ransomware-email-delivery-prevention) covers the patterns and the guide's email recommendations.

### Vendor payment fraud

Road contractors, utilities, software suppliers and construction firms bill local governments regularly, and many of those contracts are public records. That gives attackers the names, amounts and timing they need for a convincing "please update our remittance details" email. Some come from lookalike domains; others come from the vendor's real, hijacked mailbox, replying in a genuine thread. Our guides on [vendor invoice fraud](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) and [email thread hijacking](https://iblockspam.com/blog/email-thread-hijacking) explain both.

### Account takeover

A clerk's or finance officer's mailbox holds resident correspondence, permits and payment records. Once an attacker has the password, they can also send phishing to residents and vendors from a genuine government address. MFA is the main defense.

## Why should a municipality use a .gov domain?

Many towns still use a .com, .org, .us or even a free webmail address. Moving to .gov makes impersonation harder, because nobody can register a .gov without proving they're a government.

The .gov registry is run by CISA at get.gov. The key facts at the time of writing (October 2026):

- **Cost.** get.gov says .gov domains "are only available to U.S.-based government organizations, and they're free" ([get.gov](https://get.gov/domains/eligibility/)).
- **Eligibility.** Federal, state and territory, tribal, county ("a county, parish, or borough"), city ("a city, town, township, village, etc."), special district, school district (one that isn't part of a local government) and interstate organizations.
- **Naming.** Most city and county domains must include the two-letter state abbreviation or the state name, with exceptions such as city names no other US place shares.
- **Process.** You need a Login.gov account and the approval of your senior official. Review "usually takes around 10 business days", but get.gov warns it can take several weeks ([get.gov](https://get.gov/domains/before/)).
- **Security extras.** get.gov says "All newly registered .gov domains are 'preloaded'" on the HSTS preload list, and recommends publishing a security contact email and a strong DMARC policy, even on domains that don't send email ([get.gov](https://get.gov/domains/security/)).

Plan the move like any domain change. Keep the old domain, publish DMARC on it, and forward mail during the transition. Our [new domain email setup checklist](https://iblockspam.com/blog/new-domain-email-setup-checklist) covers the records you need, and [protecting parked domains](https://iblockspam.com/blog/protect-parked-domains-from-spoofing) covers the old domain once you stop sending from it.

## Does DMARC apply to local governments?

People often hear that "government must use DMARC reject". That comes from CISA's [Binding Operational Directive 18-01](https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security), issued October 16, 2017. CISA describes it as a compulsory direction to federal executive branch departments and agencies, covering their public-facing systems. It does **not** bind state or local governments.

Its email requirements are still a good model:

| BOD 18-01 email requirement | Federal deadline | Worth adopting locally? |
| --- | --- | --- |
| "All internet-facing mail servers to offer STARTTLS" | 90 days | Yes; most cloud platforms already do |
| Valid SPF and DMARC records, starting at `p=none` with reporting | 90 days | Yes |
| "a DMARC policy of 'reject' for all second-level domains and mail-sending hosts" | One year | Yes, once all legitimate senders pass |
| SSLv2 and SSLv3 disabled on mail servers | 120 days | Yes, if you run your own mail server |

CISA's joint phishing guidance makes the same point for every organization: "Ensure DMARC is set to 'reject' for sent emails" ([CISA and partners](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)).

For a municipality, the work is mostly finding every system that sends as your domain: utility billing, permit portals, agenda software, emergency notifications, payroll. Each needs SPF or DKIM aligned with your domain before you move to reject. Our [DMARC from none to reject](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) guide walks through it, and [unknown sources in DMARC reports](https://iblockspam.com/blog/unknown-sources-in-dmarc-reports) helps you identify the senders you didn't know about. To protect mail in transit, see [MTA-STS and TLS-RPT](https://iblockspam.com/blog/mta-sts-tls-rpt-explained).

## What free resources are available?

Funding for some free services changed in 2025. Check current terms before relying on any of them.

- **CISA Cyber Hygiene services.** Vulnerability scanning of internet-facing systems, with weekly reports, and web application scanning. CISA says these "are available at no cost" to federal, state, local, tribal and territorial governments and critical infrastructure organizations. To enroll, email vulnerability@cisa.dhs.gov with the subject "Requesting Cyber Hygiene Services" ([CISA](https://www.cisa.gov/cyber-hygiene-services)).
- **CISA's catalog of free services and tools.** A searchable list of CISA and third-party no-cost services. CISA notes it "does not attest to the suitability or effectiveness" of the non-CISA listings.
- **MS-ISAC.** The Multi-State Information Sharing and Analysis Center was long free for local governments. CIS now runs it as a fee-based annual membership, which it calls "a direct response to federal funding cuts", with tiers scaled to budget. Eligibility "generally includes U.S. state agencies, local governments, public education institutions" and others. Membership is now required to buy add-on services such as MDBR+ and Albert network monitoring, while CIS Benchmarks stay free for US SLTT organizations "regardless of any CIS memberships" ([CIS](https://www.cisecurity.org/ms-isac/ms-isac-membership-faq)).
- **The .gov domain itself**, free for eligible organizations.

## How should local governments protect vendor payments?

Technology helps, but process stops most payment fraud.

1. **Never change bank details based on an email.** Call the vendor using the number in your vendor file or contract, not one in the message.
2. **Require two people** to approve any bank detail change and any payment above a set amount.
3. **Notify the vendor's known contact** after any change, so a fraudulent one is spotted quickly.
4. **Watch for urgency and secrecy.** "Our bank account is under audit, please use this one today" is a red flag.
5. **Protect your own finance mailboxes** with MFA, so attackers can't send fake approvals internally.
6. **Report losses immediately.** Contact your bank and file with the FBI's IC3. Speed matters for recovering funds.

Our [business email compromise prevention guide](https://iblockspam.com/blog/business-email-compromise-prevention) has more controls.

## What about elected officials and public addresses?

Two groups often sit outside a town's normal email controls.

**Elected officials and board members** sometimes use personal Gmail or Outlook.com addresses for council business. You can't enforce MFA on those accounts, you can't recover messages when someone leaves office, and an impostor using a similar free-mail address is hard to tell apart. Give officials a .gov account, require MFA on it, and agree that any request involving money or sensitive data is confirmed by phone, whatever address it comes from.

**Public-facing addresses** such as clerk@, permits@ or info@ are published on your website and in public notices, so they receive a lot of spam and phishing. Route them to shared mailboxes that staff open with their own accounts, rather than sharing one password, and filter them with a quarantine someone reviews. Our guide to [protecting public email addresses](https://iblockspam.com/blog/protect-public-email-addresses-from-spam) covers the options.

## Local government email security checklist

1. Enforce MFA on every mailbox, starting with administrators, finance, payroll and elected officials.
2. Request a .gov domain if you don't have one, and plan the move.
3. Publish SPF, DKIM and DMARC for every domain, including old and parked ones, and move DMARC to `p=reject`.
4. Write and enforce vendor and payroll bank-change verification rules.
5. Filter inbound mail for spam, malware, phishing and risky attachments, and check that your MX records actually point to your filter.
6. Keep offline, tested backups of critical systems, as the #StopRansomware Guide advises.
7. Enroll in CISA Cyber Hygiene scanning.
8. Train staff and elected officials at least yearly, and make reporting suspicious mail easy.
9. Write an [incident response plan](https://iblockspam.com/blog/email-security-incident-response-plan) with contacts for CISA, the FBI, your insurer and your IT provider, and practice it.
10. Review accounts at least quarterly, including former staff, board members and seasonal workers.

Public records laws may also affect how long you keep email and who can request it. Ask your counsel; this guide isn't legal advice.

## Next steps

1. Check your domain's SPF, DKIM and DMARC with the free [Email Health Check](https://iblockspam.com/tools/email-health-check), and your policy with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).
2. Visit get.gov to start a .gov request if you're still on .com, .org or .us.
3. Email vulnerability@cisa.dhs.gov to request Cyber Hygiene scanning.
4. If you're evaluating filtering, our [buying checklist](https://iblockspam.com/blog/how-to-choose-a-spam-filter-small-business) is vendor-neutral. iBlockSpam filters inbound mail at the MX level with [per-domain pricing](https://iblockspam.com/pricing) and unlimited mailboxes (the mailbox count, not message volume). Mail is processed in the United States. It's one layer and doesn't replace MFA, backups or payment checks.

More guides on choosing protection are in our [buying topic](https://iblockspam.com/blog/topic/buying).

## Frequently asked questions

### Is a .gov domain free for cities and counties?

Yes. The .gov registry, run by CISA at get.gov, says .gov domains are only available to US-based government organizations and are free. Eligible organizations include counties, parishes and boroughs, cities, towns, townships and villages, special districts, school districts that aren't part of a local government, tribes, states and territories. Requests need approval from a senior official and usually take around 10 business days to review.

### Does BOD 18-01 require my town to use DMARC?

No. CISA's Binding Operational Directive 18-01 is a compulsory direction to federal executive branch departments and agencies, covering their internet-facing systems. It doesn't apply to state or local governments. Its email requirements, including a DMARC policy of reject for all second-level domains and STARTTLS on mail servers, are still a useful baseline for a municipality to follow voluntarily.

### Why move a municipality from .com or .us to .gov?

A .gov address is only available to verified US government organizations, so residents and vendors can trust it more than a .com or .org that anyone could register. That makes lookalike impersonation harder. Newly registered .gov domains are also added to the HSTS preload list, which forces browsers to use HTTPS for the domain.

### Do local governments still get MS-ISAC membership at no cost?

Not as a general rule since 2025. After federal funding cuts, the Center for Internet Security moved MS-ISAC to a fee-based annual membership with tiers scaled to budget. Local governments remain eligible, and some CIS resources stay free regardless of membership. Check the current membership FAQ for prices and included services.

### How do municipalities stop vendor payment fraud by email?

Treat every request to change a vendor's bank details as unverified until you confirm it by phone, using a number from your vendor file, not from the email. Require a second approver for changes and for large payments, and alert the vendor's known contact when details change. MFA on finance mailboxes stops attackers sending from your own accounts.

## Sources

- [get.gov: Eligibility for .gov domains](https://get.gov/domains/eligibility/)
- [get.gov: Before you request a .gov domain](https://get.gov/domains/before/)
- [get.gov: Domain security best practices](https://get.gov/domains/security/)
- [CISA: BOD 18-01: Enhance Email and Web Security](https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security)
- [CISA: Cyber Hygiene Services](https://www.cisa.gov/cyber-hygiene-services)
- [Center for Internet Security: MS-ISAC Membership FAQ](https://www.cisecurity.org/ms-isac/ms-isac-membership-faq)
- [CISA, FBI, NSA, MS-ISAC: #StopRansomware Guide (October 2023)](https://www.cisa.gov/resources-tools/resources/stopransomware-guide)
- [CISA, NSA, FBI, MS-ISAC: Phishing Guidance: Stopping the Attack Cycle at Phase One (October 2023)](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)

## Free tools for this guide

- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [MTA-STS Checker](https://iblockspam.com/tools/mta-sts-checker): Fetch and validate your MTA-STS policy, match it to your MX hosts and check TLS-RPT.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-for-local-government (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt