™Enterprise Email Security & Transport Assessment
Executive Summary
Caldwell Harbor Trust ("Caldwell Harbor"), a regional trust bank, engaged Vaixus Technologies for an independent assessment of its email transport security. Requested by the Information Security Officer following an internal audit, the engagement evaluated controls governing encryption-in-transit, DNS integrity, and delivery assurance for regulatory and correspondent-bank communications.
While Caldwell Harbor's baseline authentication (SPF, DKIM, DMARC at p=reject) is mature, this assessment focused on the underlying transport-security and DNS-integrity layers. These controls are less commonly audited but remain critical for an institution handling wire-transfer confirmations and sensitive trust correspondence.
Vaixus identified thirteen findings. Two are rated Critical: the domain's DNS zone lacks DNSSEC protection (no Delegation Signer record at the registrar), and the bank's MTA-STS policy remains in "testing" mode, providing zero active protection against TLS downgrade or interception attacks.
The assessment found no evidence of active compromise. Every finding stems from operational-maturity gaps in controls that were correctly selected but incompletely deployed or monitored. Vaixus recommends prioritizing Critical findings ahead of the next compliance review cycle.
Environment Overview
Caldwell Harbor operates a hybrid mail architecture: Microsoft 365 (Exchange Online) serves as the primary corporate mailbox platform, with a dedicated on-premises Secure Mail Gateway handling compliance journaling and enforcing transport-layer security policy for correspondent-bank traffic. All inbound and outbound correspondent-bank traffic is routed through this gateway.
| Component / Domain | Platform | Function |
|---|---|---|
| caldwellharbortrust.com | Managed DNS | Corporate mail, brand identity, public zone |
| Corporate Mail Platform | Microsoft 365 (Exchange) | Employee mailboxes |
| Secure Mail Gateway | On-Premises Hybrid | TLS enforcement, inbound routing |
| Compliance Archive | On-Premises Store | Regulatory recordkeeping for correspondence |
| mta-sts.caldwellharbortrust.com | MTA-STS Policy Host | Published transport security policy |
| _smtp._tls.caldwellharbortrust.com | TLS-RPT Configured | Aggregate TLS negotiation reporting |
Assessment Scope
- DNSSEC configuration and chain-of-trust validation
- MTA-STS policy configuration, mode, and cache lifetime
- TLS-RPT reporting configuration and review process
- Reverse DNS (PTR) coverage for outbound relay IPs
- Secure Mail Gateway STARTTLS negotiation behavior
- DKIM key rotation history and DMARC reporting
- Core banking system security and transaction controls
- Physical security of the compliance archive
- Regulatory compliance certification or examination readiness
- Endpoint security of employee workstations
- Mail content, e-discovery, or records-retention policy review
- Penetration testing of the Gateway appliance itself
Assessment Methodology
This assessment follows the Vaixus Methodology, extended with transport-security-specific validation appropriate to a regulated financial institution.
Structured interviews with Information Security to document intended controls, audit findings, and ownership.
Authoritative-record enumeration and DNSSEC chain-of-trust validation using recursive resolver testing.
Controlled SMTP sessions against the inbound relay to observe STARTTLS and MTA-STS policy behavior.
PTR record validation for every outbound relay IP address, cross-referenced against gateway configuration.
Consolidation of findings into severity-rated, business-impact-aligned recommendations.
Representative Engineering Evidence
The critical findings regarding transport security and trust integrity (CS003-01, CS003-02) were identified during the trust-chain validation phase. The domain lacked a complete DNSSEC chain of trust, and the published MTA-STS policy provided no active enforcement.
$ dig DNSKEY caldwellharbortrust.com +short 257 3 13 (public key present - zone-signing key) 256 3 13 (public key present - key-signing key) $ dig RRSIG caldwellharbortrust.com +short | head -1 SOA 13 2 3600 ... (signature present) $ dig DS caldwellharbortrust.com +short (no result - no DS record published at registrar) $ delv @8.8.8.8 caldwellharbortrust.com ; resolution failed: insecure (no chain of trust) $ curl https://mta-sts.caldwellharbortrust.com/.well-known/mta-sts.txt version: STSv1 mode: testing mx: mail.caldwellharbortrust.com max_age: 31536000
Executive Findings Summary
Vaixus identified thirteen total findings across transport security, DNS integrity, and delivery assurance. The Critical and High severity findings requiring immediate executive attention are summarized below.
Business Impact
Because DNSSEC's chain of trust is incomplete, every DNS-published control (SPF, DKIM, DMARC, MTA-STS) is retrieved by receiving systems through an unvalidated resolution path.
Caldwell Harbor's transport-security controls are not yet providing the protection its Information Security team believes they provide, in both the inbound and outbound direction.
Missing reverse DNS and unreviewed TLS reporting limit Caldwell Harbor's visibility into whether its correspondence with correspondent banks and trust clients is reliably reaching its destination today.
Remediation Strategy
Submit DS record to registrar to complete DNSSEC chain of trust. Assign named owner to TLS-RPT review and begin active monitoring. Publish missing PTR records for 3 outbound relay IPs.
Reduce MTA-STS max_age and transition policy to enforce mode. Reconfigure Secure Mail Gateway to defer rather than fall back to plaintext. Rotate DKIM key. Add ruf forensic reporting address.
Author and adopt DMARC-failure incident-response runbook. Evaluate dedicated IP allocation for Secure Mail Gateway. Review and update SOA timing parameters. Evaluate BIMI implementation.
Verification Strategy
The following methods are utilized to confirm successful remediation and closure of identified vulnerabilities across the enterprise infrastructure.
| DNSSEC Validation | DS record lookup and external DNSSEC validator confirm zone validates as "Secure" end-to-end. |
| MTA-STS & STARTTLS | MTA-STS policy fetch and simulated downgrade trace test confirm enforcement and refusal of downgrade. |
| Reverse DNS (PTR) | Reverse DNS lookup across all six relay IPs confirms matching, forward-confirmed hostnames. |
| Reporting & Auth | TLS-RPT recipient access confirmed, new DKIM selector validated, and DMARC record verified for RUF. |
Download the Complete Representative Report
This webpage summarizes the investigation logic. The complete 27-page PDF report contains full DNS trace evidence, detailed technical findings, risk prioritization tables, and structured remediation guidelines.
Download Representative Report (PDF)Ready to begin an assessment?
Submit a request and we will review your domain, scope the engagement, and respond within one business day.
Request Assessment