Votebeat is a nonprofit news organization reporting on voting access and election administration across the U.S. Sign up for Votebeat Wisconsin’s free newsletter here.
When Lac Du Flambeau Town Clerk Susan Schoonover began her job four years ago, the town’s technology infrastructure was in a bygone era.
The 3,500-person town had no official website, and staff used ordinary email accounts for town business. That could have made it easier for someone to impersonate the town, send convincing phishing messages or steer residents to a fake site. Residents had no verified government domain to tell them which messages and websites were real.
A programmer, Schoonover made changing that setup an early priority. The town got a grant to move staff onto government email addresses, she built an official website using a government domain, and she persuaded the town board to keep investing in cybersecurity even as its property tax revenue shrank.
Lac du Flambeau now stands ahead of hundreds of other small towns in Wisconsin that still use non-government domains, which experts say runs afoul of cybersecurity best practices.
A Votebeat analysis of state data found that about one in three Wisconsin clerks still use Gmail, Hotmail, Yahoo or other consumer email accounts for election business — and every municipality using one has fewer than 5,000 residents. Most have fewer than 1,000. On the other hand, among municipalities with more than 25,000 residents, not a single clerk uses a consumer account.
It’s a genuine risk not to have government domains, said Trevor Timmons, vice president of the nonpartisan election consultation group Ready for Tuesday. Government sites are “harder to spoof” and “harder to successfully send phishing attacks to,” Timmons said. Phishing is when a scammer sends a link designed to obtain the recipients’ personal information.
The threat isn’t just hypothetical. Hackers tried to breach the emails of election officials in at least nine states in 2021. In November 2016, Russian hackers sent over 120 emails containing malicious software to the email accounts of election officials in Florida. In 2020, the FBI identified dozens of URLs that looked like real election websites, which government officials said could be used to phish or post incorrect election information.
Wisconsin looks relatively typical when viewed statewide. A Bipartisan Policy Center analysis found that about 43% of Wisconsin municipalities and counties with listed websites use government domains, roughly the 44% national average. But that average masks how uneven the technological progress has been: larger jurisdictions have largely modernized, while many of the smallest have not.
“The big difference with .gov is not necessarily that the cybersecurity is so much better, but that your visitors can know that they’re getting information from a trusted, verified government entity,” said William Adler, research director of the Bipartisan Policy Center’s Elections Project.
That becomes harder when real election officials use Gmail, Hotmail and similar accounts.
“If you were to tell a voter, ‘Don’t trust any email coming from an election official that’s from a Hotmail.com address,’ they might ignore real election official communications that they need to respond to in order to vote more easily,” Adler said, adding that it will take a while to get to the ideal point where most or all election jurisdictions use government domains.
Wisconsin’s decentralized election system makes closing the gap difficult. The state has 1,850 municipal clerks and 72 county clerks with roles in running elections, many serving tiny jurisdictions with little or no dedicated IT staff.
“Many of these municipalities don’t have much in the way of IT resources, so it’s fairly impressive that Wisconsin has managed to stay on par with the rest of the country,” Adler said.
The state has spent years — and millions of dollars — trying to help local election offices improve election security and move onto government domains. Hundreds have taken advantage of that help. But the jurisdictions still behind are concentrated in the smallest places.
Consumer emails may have been the norm 30 years ago, Schoonover said, but now towns need to modernize or else risk having their systems tampered with or their data wiped out.
“The way the world’s changed, it can’t always be like old times,” she said.
Wisconsin has spent years funding local election cybersecurity
While some small towns manage the cost of hosting government domains, the expense can be significant for rural municipalities with tiny budgets and little or no IT staff.
In Big Bend, a Rusk County town with around 400 residents, the town board is working through its options because its current email provider, Bruce Telephone Company, is cutting off its email hosting services, Town Clerk Sandy Rassbach said. The town is now choosing between a consumer email provider like Gmail, or switching to a government domain, she said.
A couple thousand dollars to maintain a government domain is a big expense for a town, she said.
About 49% of Wisconsin election jurisdictions use government email domains, while another 18% use custom domains tied to their municipality. Those custom addresses can have strong security protections, but unlike .gov addresses, they are not restricted to verified government entities.
The Wisconsin Elections Commission has spent years helping local governments improve election security, including through grants specifically aimed at moving municipalities to government domains. But the federal money supporting the programs is dwindling — and WEC has warned that the state may eventually need to step in if it wants to keep subsidizing local election-security upgrades.
“If the Legislature wants to see elections in large cities and small towns become more uniform, they may wish to provide funding for WEC to continue to administer subgrants or to directly fund elections for municipalities,” the commission stated in July 2026 budget materials outlining the agency’s future funding needs.
Separately, Wisconsin Emergency Management is administering $4.7 million in federal grants to jurisdictions vulnerable to cybersecurity attacks.
Registering a government domain itself is free, Timmons said. The expense comes from services such as email hosting, technical support and security, which can cost hundreds or thousands of dollars a year.
It would be ideal for providers to offer their services at no cost or reduced costs for election officials, he said, “but it hasn’t quite gotten there yet.”
Timmons said it’s hard for small-town clerks working part-time hours with no IT department to switch to government emails.
One way to accelerate the shift, he said, would be for the commission to condition future election-security grants on jurisdictions already having — or agreeing to adopt — government emails.
The commission already conditions grants on certain security requirements. For example, municipalities can only receive the current round of $2,000 election security subgrants if they first use the funds to update operating systems and antivirus software.
Those are critical, Timmons said — and so are government domains.
The elections commission in 2021 told clerks that officials with non-government emails would eventually be cut off from some state services, though that hasn’t come to pass. Many of those services have protections designed to prevent unauthorized access, like multi-factor authentication.
Small towns with little funding likeliest not to have government domains
The disparity is particularly stark in northern Rusk County, a rural county with 14,000 residents spread across 33 municipalities. Twenty-seven of its clerks use consumer email addresses like Gmail, Yahoo and Outlook.
Willard is one of the exceptions. Town deputy treasurer Linda Bentley, who has an IT background, spearheaded the town’s switch to government email domains four years ago after she recognized that officials in the Rusk County town were using multiple consumer email domains, like Gmail and Yahoo.
Before the switch, she said, “you really weren’t sure you were getting to the Willard town clerk.”
Town Clerk Mary Jane Nelson said she is “absolutely” more confident communicating with voters now, and she receives significantly fewer spam emails.
“It’s really been a great move, as far as I’m concerned,” she said.
Making that change has required ongoing spending. The town pays $400 every three years for server space, and Bentley charges $200 a year for email security and design — significantly below market rates. Bentley said other nearby towns spend up to $2,000 a year on server space, maintenance and security.
Not every jurisdiction without a government domain is relying on Gmail or Yahoo. Around 360 municipalities use custom domains unique to their municipality, such as kenosha.org or cityofmiddleton.us. Those addresses can have strong security protections, but unlike .gov, they are not restricted to verified government entities.
Those custom domains span the size spectrum, from Fence in Florence County, with fewer than 200 residents, to Madison, with about 285,000. Kenosha is the largest Wisconsin city without a registered government domain for its email or website. Consumer email accounts, by contrast, are concentrated entirely in small municipalities.
It’s often easier to change to government domains if a municipality already has a paid, custom domain, Timmons said, though the switch still requires some technical expertise.
With the November election approaching, Timmons said jurisdictions shouldn’t make major changes to their email systems now. But they can still contact CISA and begin applying for a government domain to prepare for the change after the election.
“I would encourage people to get the ball rolling on that,” he said.
Bentley is glad the Town of Willard has already taken those steps. The switch gave the town something more basic: a recognizable identity online.
“It’s become our signature,” she said, “our confidence that you know you’re emailing the town clerk for the town of Willard, not some spoofed address.”
Alexander Shur is a reporter for Votebeat based in Wisconsin. Contact Alexander at ashur@votebeat.org.
