Product guide
Higher Education Market Index
The Higher Education list of the Market Index ranks the DNS posture of US four-year colleges and universities, using each institution’s website from the federal IPEDS directory and grouping them by Carnegie classification.
The short answer
Use the Higher Education list to compare how well colleges run their DNS: email authentication, DNSSEC, CAA and delegation health, graded with the Security Posture grade from nine of its cards: Email Security, DNS Security, TLS and Certificates, Website Application Security, Endpoint Security, IP and Asset Reputation, Human and Social Engineering Exposure, Trust Center and Privacy. Brand Protection, Attack Surface, Network Security, Vulnerability Management and Credential Exposure take far more requests or paid services, so they aren’t checked here, and the Security Posture page can grade more areas than the score stored here. It is reference data for research and peer comparison, not a ranking of the institutions themselves.
Sort by Carnegie classification to compare like with like, such as research universities with each other or liberal arts colleges with each other, then open a college’s domain in Domain Visualizer for the record-level evidence.
What is in the list
The list holds US institutions that are four-year or above, grant degrees and are open, as the directory reports them. Public, private non-profit and private for-profit institutions are all included; system and district offices are left out because they are administrative bodies, not colleges. That comes to roughly 2,800 institutions.
Each row shows the institution’s name, its domain, its state, its Carnegie classification and research designation, and its latest DNS score and grade. Where two institutions share a name, the state (then the city) is added so each row is distinct.
Where the data comes from
Names, states, websites and classifications come from the Integrated Postsecondary Education Data System (IPEDS), run by the US Department of Education’s National Center for Education Statistics. The list is built from the IPEDS Institutional Characteristics directory file for the 2023 collection year (HD2023). It is not refreshed automatically: it changes when an administrator imports a newer directory file, so a college that opened, closed or changed its website since that file may not be reflected yet.
The domain is the website address the institution reports to IPEDS, without the leading www. When that address is wrong or out of date, the domain is corrected by hand, and a hand-set domain is never overwritten by the next import.
How often it is scored
Each organization on the list gets a fresh DNS score about once a month: the list is set to score every 30 days, and the work is spread across the month after the day’s S&P 500 scores, so a few organizations are re-checked every day rather than all of them at once.
A score counts only when every DNS lookup behind it was answered. The page shows each organization’s latest such score and its date, so an older score is labelled rather than hidden. For record-level investigation, open Domain Visualizer; for grades and remediation, use Security Posture. Check the Cached badge and timestamp: saved scans last 24 hours by default and are not necessarily fresh lookups. Query authoritative servers directly for immediate verification.
What the columns mean
The Carnegie classification is the Carnegie Classification of Institutions of Higher Education’s Basic Classification, 2021 edition (the 2018 edition where an institution has no 2021 one). It groups institutions by the degrees they award and how much research they do, which makes it the fairest way to pick peers. These are historical classifications. The Carnegie Classifications were redesigned for their 2025 edition, with new categories, and this list has not adopted the 2025 scheme, so its groups will not match colleges' current Carnegie listings in every case.
| Group | What it covers |
|---|---|
| Doctoral Universities | Institutions awarding at least 20 research doctorates a year. Very High Research Activity is known as R1, High Research Activity as R2; both appear in the research designation column. |
| Doctoral/Professional Universities | Institutions whose doctorates are mostly professional, such as law, medicine or education. |
| Master’s Colleges & Universities | Institutions awarding at least 50 master’s degrees a year, split into larger, medium and small programs. |
| Baccalaureate Colleges | Institutions where bachelor’s degrees are the main award: Arts & Sciences Focus (liberal arts colleges) or Diverse Fields. |
| Baccalaureate/Associate’s Colleges | Four-year institutions that also award many associate’s degrees. |
| Special Focus Four-Year | Institutions concentrated in one field: medical schools, law schools, business, engineering, arts and design, faith-related institutions and others. |
| Tribal Colleges and Universities | Members of the American Indian Higher Education Consortium. |
The research designation column shows R1 or R2 for doctoral universities and is empty for everyone else. The state is the institution’s main campus state in IPEDS.
FAQ
Why is a college missing from the list?
The list only includes open, degree-granting institutions that IPEDS records as four-year or above. Two-year colleges, branch campuses that report under a parent institution and institutions that closed are not in the directory file the list is built from.
Why does a college show no score?
Either its domain has not been scored yet in the current monthly cycle, or one of the DNS lookups behind its score went unanswered, in which case it is tried again later. The section on how often the list is scored explains the cycle.
Is the score a rating of the college?
No. It measures how a single domain’s DNS is configured. It says nothing about teaching, research or the institution’s wider IT security.