Hubbard County
41/100
#86 of 87 in Minnesota
31/100
1 of 8 checks passed
Website
54/100
4 of 11 checks passed
Domain
40/100
2 of 5 checks passed
What to fix first
- +15Set DMARC to p=reject
- +6Turn on DNSSEC
- +5Send an HSTS header for a year
- +4Redirect http:// to https://
- +4Turn on MTA-STS in enforce mode
- +3Add a CAA record
Plus 10 smaller fixes below.
Email31/100
Stops people from sending fake email that looks like it came from the county.
Partly Fake email gets blocked (DMARC)DMARC is only watching (p=none). Fake email that uses the county's address still lands in inboxes. 5/20
Why it matters. A DMARC policy tells Gmail, Outlook and every other mail service what to do with email that claims to be from the county but isn't. With p=reject the fake mail is thrown away. With p=quarantine it goes to spam. With p=none nothing happens to it.
How to fix it. Publish a TXT record at _dmarc.hubbardcounty.gov. Start with v=DMARC1; p=none; rua=mailto:dmarc@hubbardcounty.gov and read the reports for a few weeks. Once every real sender passes, change p=none to p=quarantine, then to p=reject.
What we saw
_dmarc.hubbardcounty.gov: v=DMARC1; p=none
Fail Made-up subdomains are covered tooMail from made-up subdomains isn't blocked because the main policy is none. 0/3
Why it matters. Scammers can send from addresses like billing.hubbardcounty.gov that the county never set up. The DMARC record decides what happens to that mail with its sp= setting.
How to fix it. Subdomains follow the main p= policy unless the record says otherwise. Move p= to quarantine or reject, and leave out sp=none (or set sp=reject).
What we saw
_dmarc.hubbardcounty.gov: v=DMARC1; p=none
Fail The county gets DMARC reportsThe DMARC record doesn't ask for reports (no rua=), so the county can't see who sends mail in its name. 0/3
Why it matters. Reports show every server sending mail in the county's name, real or fake. They are how the county knows it is safe to turn on blocking.
How to fix it. Add rua=mailto:dmarc@hubbardcounty.gov (or a reporting service's address) to the DMARC record.
What we saw
_dmarc.hubbardcounty.gov: v=DMARC1; p=none
Partly Approved mail servers are listed (SPF)SPF lists the approved servers but only calls other servers suspicious (~all) instead of fake (-all). 6/8
Why it matters. SPF lists the servers allowed to send the county's email. Ending it with -all tells receivers that every other server is fake.
How to fix it. Publish one TXT record on hubbardcounty.gov that starts with v=spf1, lists each service that sends your mail (for Microsoft 365, include:spf.protection.outlook.com) and ends with -all.
What we saw
v=spf1 ip4:208.80.200.0/21 ip4:151.111.29.0/24 include:spf.protection.outlook.com ~all
Pass SPF stays under the 10 lookup limitSPF needs 1 of the 10 allowed lookups. 2/2
Why it matters. Mail services stop reading an SPF record after 10 lookups. Past that, the whole record counts as broken and stops protecting anything.
What we saw
v=spf1 ip4:208.80.200.0/21 ip4:151.111.29.0/24 include:spf.protection.outlook.com ~all
Couldn't check Outgoing mail is signed (DKIM)We didn't find a DKIM key under the common names. The county may still sign its mail under a name we can't guess, so this doesn't lower the score. -
Why it matters. DKIM adds a signature to every message, so receivers can tell it really came from the county and wasn't changed on the way. Keys live under names the county picks, so this check only looks at the common ones. Not finding a key never lowers the score.
Fail Incoming mail must be encrypted (MTA-STS)hubbardcounty.gov has no MTA-STS record, so other servers may deliver mail to it without encryption. 0/4
Why it matters. Without MTA-STS, someone in the middle of the network can quietly strip the encryption off mail sent to the county and read it. MTA-STS in enforce mode tells sending servers to refuse that.
How to fix it. Host a policy file at https://mta-sts.hubbardcounty.gov/.well-known/mta-sts.txt with mode: enforce and your MX hosts, then publish TXT _mta-sts.hubbardcounty.gov "v=STSv1; id=1". Start with mode: testing if you want to watch first.
Fail The county hears about failed encrypted deliveryNo TLS report record, so the county never hears when secure delivery fails. 0/2
Why it matters. TLS reports tell the county when other servers could not deliver mail to it securely, which can mean a broken certificate or an attack.
How to fix it. Publish TXT _smtp._tls.hubbardcounty.gov "v=TLSRPTv1; rua=mailto:tlsrpt@hubbardcounty.gov".
Website54/100
Keeps visits to the county website private and hard to tamper with.
Pass The website uses HTTPS with a valid certificateThe website loads over HTTPS with a trusted certificate. 10/10
Why it matters. HTTPS keeps what visitors read and type on the site private, and proves they reached the real county site. A broken or expired certificate shows people a scary warning.
What we saw
https://www.hubbardcounty.gov/
Fail http:// visitors are sent to https://The http:// version of the site loads without encryption instead of redirecting. 0/4
Why it matters. People still type addresses without https. If the plain version of the site loads, those visits travel unprotected.
How to fix it. Set the web server to answer every http:// request with a permanent (301) redirect to the same https:// address.
What we saw
http://www.hubbardcounty.gov/ answered HTTP 200
Fail Browsers are told to always use HTTPS (HSTS)The site doesn't send an HSTS header, so browsers may try the insecure version first. 0/5
Why it matters. HSTS makes browsers remember to use the secure site, so nobody on public Wi-Fi can trick them into the insecure one first.
How to fix it. Send the header Strict-Transport-Security: max-age=31536000 on every HTTPS page. Add includeSubDomains once every county subdomain supports HTTPS.
Pass The newest encryption (TLS 1.3) worksTLS 1.3 works. 3/3
Why it matters. TLS 1.3 is faster and drops the weak options older versions allowed.
Pass Retired encryption (TLS 1.0 and 1.1) is turned offTLS 1.0 and 1.1 are turned off. 4/4
Why it matters. TLS 1.0 and 1.1 have known weaknesses and every major browser dropped them in 2020. Leaving them on only helps attackers.
Pass The certificate isn't about to expireThe certificate is good for 58 more days. 2/2
Why it matters. When a certificate expires, every visitor sees a security warning and many can't reach the site at all.
What we saw
Expires 2026-12-11, issued by Let's Encrypt
Fail Scripts are limited (Content Security Policy)No Content Security Policy, so any script that gets onto a page can run. 0/2
Why it matters. A Content Security Policy lists where scripts on the site may come from. If an attacker slips code into a page, the browser refuses to run it.
How to fix it. Send a Content-Security-Policy header. Many CMS vendors document one that fits their platform.
Fail Browsers don't guess file typesNo X-Content-Type-Options: nosniff header. 0/1
Why it matters. Without this header a browser may run an uploaded file as a script just because it looks like one.
How to fix it. Send the header X-Content-Type-Options: nosniff.
Fail Other sites can't frame the county siteAny site can load the county site inside a frame. 0/1
Why it matters. A fake site can load the real county site in a hidden frame and trick people into clicking buttons they can't see.
How to fix it. Send X-Frame-Options: SAMEORIGIN, or frame-ancestors 'self' in the Content-Security-Policy.
Fail Visitors' page addresses aren't shared with other sitesNo Referrer-Policy header. Most browsers now default to a safe setting, but the site doesn't ask for one. 0/1
Why it matters. A referrer policy stops the full address of the page someone was on, which can include search terms or case numbers, from being sent to other sites.
How to fix it. Send the header Referrer-Policy: strict-origin-when-cross-origin.
Fail Security problems can be reported (security.txt)There is no security.txt file at https://www.hubbardcounty.gov/.well-known/security.txt. 0/2
Why it matters. A security.txt file tells people who find a problem with the county's systems exactly who to tell. Without it, many reports never arrive.
How to fix it. Publish https://www.hubbardcounty.gov/.well-known/security.txt with a Contact: line (an email address or form) and an Expires: date.
Domain40/100
Protects the county's internet address itself.
Pass Uses a .gov domainThe website and email both use a .gov address. 6/6
Why it matters. Only real US government bodies can get a .gov address, and it is free for them. People can trust a .gov address in a way they can't trust a .us or .com one.
What we saw
www.hubbardcounty.gov, hubbardcounty.gov
Fail DNS answers are signed (DNSSEC)DNS answers aren't signed, so they can be forged. 0/6
Why it matters. DNSSEC signs the county's DNS records, so nobody can send visitors or email to a fake server by forging the answers.
How to fix it. Turn on DNSSEC with your DNS host, then add the DS record it gives you at your registrar (for .gov, in the get.gov dashboard).
What we saw
hubbardcounty.gov: unsigned
Fail Only chosen companies can issue certificates (CAA)There is no CAA record, so any certificate company may issue certificates for the domain. 0/3
Why it matters. A CAA record lists the certificate companies the county uses. Every other company must refuse to issue a certificate for the county's domain.
How to fix it. Add a CAA record such as 0 issue "letsencrypt.org" (or your certificate provider) to the domain.
Pass Name servers in more than one address blockThe domain has name servers in more than one address block. 2/2
Why it matters. If all of a domain's name servers sit on one network, one outage takes the website and email offline together.
What we saw
hubbardcounty.gov: ns1.state.mn.us, ns2.state.mn.us, ns3.state.mn.us
Fail The website works over IPv6The website has no IPv6 address. 0/3
Why it matters. Many phone networks and newer internet connections use IPv6. A site with an IPv6 address is reachable over them directly.
How to fix it. Ask your hosting provider or CDN to turn on IPv6 and publish an AAAA record for the site.
What we saw
www.hubbardcounty.gov has no AAAA record
Hubbard and its neighbors
| 32 | Beltrami | D62 | 43 | 89 | 55 | ||||||||||||||
| 32 | Clearwater | D62 | 69 | 66 | 40 | ||||||||||||||
| 43 | Cass | F52 | 42 | 74 | 40 | ||||||||||||||
| 53 | Becker | F50 | 42 | 66 | 40 | ||||||||||||||
| 63 | Wadena | F48 | 42 | 69 | 25 | ||||||||||||||
| 86 | Hubbard | F41 | 31 | 54 | 40 | ||||||||||||||
| No counties match. | |||||||||||||||||||
Score history
First checked on Oct 13, 2026. The history chart fills in as daily scans add up.
This score only covers settings anyone can see from the internet. It can't see passwords, backups, staff training or anything inside the county's network, so a high score doesn't mean a county is safe, and a low one doesn't mean it has been hacked.
Work for Hubbard County and something looks wrong? Email hello@govleaderboard.com and we'll recheck it. Last checked Oct 13, 2026, 3:02 PM CT.
Looking for Hubbard County offices and records? Find them on GISFinder.