Texas higher education is split between large public systems and well-known private universities. We audited system apex domains and representative private campuses on July 13, 2026, scoring each against the 100% ideal.
Public Systems vs Private Campuses
| Type | Institution | Domain | Overall | Identity | Transport | Website | Level |
|---|---|---|---|---|---|---|---|
| Public system | Texas A&M University System | tamus.edu | 62% | 70% | 15% | 45% | Above Average |
| Public system | The University of Texas System | utsystem.edu | 54% | 50% | 15% | 45% | Average |
| Private | University of St. Thomas – Houston | stthom.edu | 69% | 65% | 45% | 70% | Above Average |
| Private | Texas Christian University | tcu.edu | 58% | 25% | 15% | 92% | Average |
| Private | University of Dallas | udallas.edu | 56% | 20% | 15% | 92% | Average |
| Private | Rice University | rice.edu | 44% | 25% | 15% | 45% | Below Average |
| Private | Southern Methodist University | smu.edu | 44% | 25% | 15% | 45% | Below Average |
Flagship public campuses (for context)
| Institution | Domain | Overall | Identity | Transport | Website |
|---|---|---|---|---|---|
| Texas A&M University | tamu.edu | 76% | 65% | 45% | 92% |
| UT Austin | utexas.edu | 54% | 50% | 15% | 45% |
Takeaways
| Finding | Detail |
|---|---|
| Ideal score | Nobody in this set reached 100% overall |
| Best private | St. Thomas – 69% (also a recent OAG filer) |
| System vs flagship | A&M campus (76%) beats A&M System apex (62%) — foundations and admin domains often lag |
| Private identity trap | Rice/SMU/TCU/UD identity scores 20–25% invite spoofed advancement and admissions mail |
| Shared transport gap | System apexes and most privates stuck at 15% transport |
A strong website score (TCU/UD 92%) does not stop mail spoofing. After Nelson, Dallas, and SMU disclosures, weak identity becomes a follow-on phishing multiplier.
Website stack note
- UT System (
utsystem.edu): Drupal behind current (running 11; latest 11.4.2) - St. Thomas – Houston (
stthom.edu): WordPress behind current (running 6.9.4; latest 7.0.1)
Priority Actions
Public systems: Align foundation, hospital, and Shared Services domains with the strongest campus DMARC policy — spoofed @tamus.edu / @utsystem.edu procurement mail is high-ROI for attackers.
Private universities: Move identity from ~25% to reject; pair with MTA-STS enforce before the next advancement campaign cycle.
Related Coverage
audit.emailmenow.com · Contact
Methodology: Audited July 13, 2026. 100% is the ideal.