™Multi-Provider Enterprise Authentication Assessment
Executive Summary
Meridian Fintech Group ("Meridian") engaged Vaixus Technologies to assess its enterprise email authentication posture following three acquisitions. Each acquisition introduced separate email infrastructure, DNS conventions, and sending platforms. IT leadership required an independent inventory after an internal audit revealed no single team could produce a complete list of authorized senders for the root domain.
The assessment evaluated seven distinct sending identities sharing a single root DNS zone: Meridian's root domain (Microsoft 365), a retained Google Workspace tenant, SES and SendGrid transactional streams, a legacy Mailgun integration, a Resend developer platform, and HubSpot marketing.
Vaixus identified thirteen findings. Two are rated Critical: the root domain's SPF record has accumulated includes from every vendor and exceeds the RFC 7208 ten-lookup limit, and an orphaned Mailgun stream from a decommissioned platform continues to send monthly account statements with no assigned internal owner.
The assessment found no evidence of active compromise. Every finding traces to the absence of a unifying sender-governance model across the merged organizations. Vaixus recommends establishing a centralized authorized-sender inventory as the foundational remediation step.
Environment Overview
Meridian's current footprint is the product of three acquisitions. Corporate correspondence for the parent organization is served by Microsoft 365 on the root domain. Each acquired or newly built business unit layered its own sending platform on top of this shared root DNS zone, resulting in seven identities sharing Route 53 as the authoritative DNS provider.
| Domain | Platform | Function |
|---|---|---|
| meridianfg.com | Microsoft 365 | Corporate mail, root DNS zone |
| ledgerpay.meridianfg.com | Google Workspace | Subsidiary correspondence |
| app.meridianfg.com | Amazon SES | Product notifications |
| billing.meridianfg.com | SendGrid | Invoices and receipts |
| legacy.meridianfg.com | Mailgun | Acquired platform mail |
| developers.meridianfg.com | Resend | Developer platform alerts |
| marketing.meridianfg.com | HubSpot | Lifecycle marketing |
Assessment Scope
- Root domain and subdomain DNS records across Route 53 and GoDaddy
- SPF, DKIM, and DMARC configuration across all 7 sending identities
- Post-acquisition integration state of LedgerPay Google Workspace
- Ownership of the legacy Mailgun sending stream
- DKIM key age, rotation cadence, and DMARC subdomain policy
- Application security of Meridian's payments platforms
- PCI-DSS or regulatory compliance certification
- Internal network security and corporate firewall configuration
- Endpoint security of employee workstations
- Mail content, data residency, or cross-border transfer analysis
Assessment Methodology
This assessment follows the Vaixus Email Infrastructure Assessment Methodology, adapted for a multi-entity, post-acquisition environment.
Structured interviews across IT, Engineering, Finance, and Marketing to reconstruct an as-built sender inventory.
Authoritative-record enumeration across the Route 53 zone and residual legacy zones to establish the configuration.
Controlled test messages sent through each of the seven sending identities with full header capture and alignment analysis.
Direct review of administrative consoles cross-referenced against internal ownership records (or their absence).
Consolidation of findings into severity-rated, business-impact-aligned recommendations.
Representative Engineering Evidence
The critical findings regarding vendor governance and DNS limits (CS002-01, CS002-02) were identified during the initial reconnaissance phase. The root domain's SPF record had accumulated excessive vendor includes, and an orphaned legacy sending stream remained actively authenticated.
$ dig TXT meridianfg.com +short | grep spf1 "v=spf1 include:spf.protection.outlook.com include:amazonses.com include:sendgrid.net include:mailgun.org include:_spf.hubspotemail.net include:spf.resend.com ~all" Lookup expansion: spf.protection.outlook.com -> 2 nested lookups (Microsoft 365) amazonses.com -> 1 nested lookup sendgrid.net -> 2 nested lookups mailgun.org -> 2 nested lookups (legacy, see CS002-02) _spf.hubspotemail.net -> 2 nested lookups spf.resend.com -> 2 nested lookups (see CS002-06) TOTAL = 10 nested + 1 base lookup = 11 $ dig MX legacy.meridianfg.com +short 10 mxa.mailgun.org. 10 mxb.mailgun.org. $ dig TXT legacy.meridianfg.com +short | grep spf1 "v=spf1 include:mailgun.org ~all"
Executive Findings Summary
Vaixus identified thirteen total findings across DNS configuration, vendor governance, and authentication posture. The highest severity findings requiring executive attention are summarized below.
Business Impact
The least security-conscious onboarding decision (an un-isolated SPF include) threatens the deliverability of the most business-critical mail stream (Microsoft 365) because all sending identities share one root DNS zone.
A real communication obligation persists on unmonitored infrastructure with no assigned owner, creating a risk that customer statements could silently fail if the legacy domain breaks.
A Meridian-branded subsidiary domain remains fully unenforced, increasing brand and phishing-impersonation exposure beyond what Meridian's IT leadership currently believes their DMARC investment provides.
Without a centralized sender inventory and onboarding checkpoint, each future acquisition or vendor relationship will likely reproduce the exact same categories of findings.
Remediation Strategy
Complete Route 53 migration for remaining legacy subdomains to unify DNS management. Assign named ownership and monitoring to the legacy Mailgun stream.
Isolate all vendor sending onto dedicated subdomains and correct root SPF record. Configure custom MAIL FROM for SES and complete SendGrid Return-Path. Add explicit subdomain DMARC policies.
Align LedgerPay DMARC policy with parent organization. Adopt a 12-month enterprise DKIM rotation cadence. Publish and enforce a centralized authorized-sender inventory.
Verification Strategy
The following methods are utilized to confirm successful remediation and closure of identified vulnerabilities across the enterprise infrastructure.
| DNS & SPF Resolution | SPF lint validation on root and all subdomains confirming ≤ 2 lookups; each subdomain independently valid. |
| DMARC Enforcement | DMARC record and DKIM key inspection confirming subsidiary policy alignment and key rotation. |
| Authentication Paths | Trace test with full alignment analysis ensuring both SPF and DKIM pass correctly. |
| Vendor Governance | Inventory accessible, owned, and referenced in onboarding checklists with documented rotation schedules. |
Download the Complete Representative Report
This webpage summarizes the investigation logic. The complete 28-page PDF report contains full DNS trace evidence, detailed technical findings, risk prioritization tables, and structured remediation guidelines.
Download Representative Report (PDF)Ready to begin an assessment?
Submit a request and we will review your domain, scope the engagement, and respond within one business day.
Request Assessment