™Revenue Deliverability Infrastructure Assessment
Executive Summary
Northlane Software, Inc. ("Northlane") engaged Vaixus Technologies to assess its outbound sales infrastructure following a sustained decline in reply and meeting-booked rates across its North American and EMEA pods. Northlane treats this infrastructure as a revenue-critical system, supporting prospecting and account management for a combined organization of 54 representatives.
The assessment evaluated DNS infrastructure, authentication configuration (SPF, DKIM, DMARC), domain segmentation strategy, and the technical integration of Northlane's outbound stack.
Vaixus identified thirteen findings. Two are rated Critical: the corporate domain's SPF record exceeds the RFC 7208 lookup limit, causing hard delivery failures; and a secondary outbound domain was provisioned inside the corporate Google Workspace tenant, improperly sharing the corporate MX destination and trust boundary.
Environment Overview
Northlane's revenue organization relies on a modern outbound technology stack layered on top of Google Workspace. Outbound sending is distributed across dedicated sending platforms which route mail through secondary domains intended to be kept operationally separate from the corporate domain.
| Domain | Platform | Function |
|---|---|---|
| northlanesoftware.com | Google Workspace | Corporate mail, system of record |
| mail.northlanesoftware.com | SendGrid | Transactional (notifications, billing) |
| northlanehq.io | Smartlead | North America SDR cold outbound |
| northlane-connect.com | Instantly | EMEA SDR cold outbound |
| meetnorthlane.com | Instantly | Account Executive demo-scheduling |
Assessment Scope
- DNS infrastructure for all sending domains
- SPF, DKIM, and DMARC configuration and alignment
- MX configuration and inbound mail routing architecture
- Domain architecture and sending-domain segmentation strategy
- Third-party sending service configuration
- Endpoint security of employee workstations
- Web application security or source code review
- Internal network security and corporate firewall configuration
- Employee security awareness training
- Mail content, copywriting, or sequence messaging review
Assessment Methodology
This assessment follows the five-stage Vaixus Email Infrastructure Assessment Methodology.
Structured interviews to document intended architecture, ownership, and prior incidents.
Authoritative-record enumeration across all in-scope domains to establish the as-built configuration.
Controlled test messages sent through each sending platform with full header capture.
Direct review of administrative consoles to confirm published DNS records match configuration.
Consolidation of findings into severity-rated, business-impact-aligned recommendations.
Representative Engineering Evidence
The critical finding regarding MX trust boundary overlap (CS001-01) was identified during the DNS reconnaissance phase. The secondary domain, intended to be isolated, was found to be sharing the primary corporate Google Workspace MX cluster.
$ dig MX northlanehq.io +short 1 aspmx.l.google.com. 5 alt1.aspmx.l.google.com. 5 alt2.aspmx.l.google.com. 10 alt3.aspmx.l.google.com. 10 alt4.aspmx.l.google.com. $ dig MX northlanesoftware.com +short 1 aspmx.l.google.com. 5 alt1.aspmx.l.google.com. 5 alt2.aspmx.l.google.com. 10 alt3.aspmx.l.google.com. 10 alt4.aspmx.l.google.com.
Executive Findings Summary
Vaixus identified thirteen total findings. The Critical and High severity findings requiring immediate executive attention are summarized below.
Business Impact
The SPF lookup limit violation creates intermittent, hard-to-diagnose delivery failures against exactly the enterprise-gateway-protected recipients that represent Northlane's target buyer profile.
The corporate domain has no enforcement policy against spoofing, and the secondary outbound domain's inbound path is not isolated from corporate infrastructure.
Absent reporting visibility, inconsistent naming, and ad hoc onboarding practice compound over time as the sales organization continues to scale, increasing time-to-diagnose for future incidents.
Remediation Strategy
Remove northlanehq.io as Workspace secondary domain; re-provision isolated MX. Correct primary domain SPF record to resolve ≤9 lookups. Begin staged DMARC enforcement ramp.
Author and adopt sending-mailbox warm-up policy. Rotate Google Workspace DKIM key to 2048-bit. Add DMARC rua reporting to remaining secondary domains.
Standardize DKIM selector naming across vendors. Evaluate/implement backup MX for meetnorthlane.com. Advance primary domain DMARC to p=reject.
Verification Strategy
The following methods are utilized to confirm successful remediation and closure of identified vulnerabilities across the enterprise infrastructure.
| Domain Segmentation | DNS MX lookup and Workspace Admin Console review confirms MX no longer matches corporate cluster. |
| DNS & Authentication | SPF lint validation confirms ≤ 10 lookups; trace test confirms explicit SPF Pass. |
| DMARC Enforcement | Weekly DMARC aggregate report review confirms zero unexpected alignment failures at each ramp stage. |
| Deliverability Governance | Smartlead per-mailbox send-limit audit confirms all active mailboxes conform to documented ramp schedule. |
Download the Complete Representative Report
This webpage summarizes the investigation logic. The complete 28-page PDF report contains full DNS trace evidence, detailed technical findings, risk prioritization tables, and structured remediation guidelines.
Download Representative Report (PDF)Ready to begin an assessment?
Submit a request and we will review your domain, scope the engagement, and respond within one business day.
Request Assessment