How to use domain health checks for MSP prospecting
Michael Ko
Co-founder & CEO, Suped
Published 21 Jun 2026
Updated 21 Jun 2026
10 min read
Summarize with
Domain health checks turn MSP prospecting from a generic security conversation into a concrete risk conversation. I use them to show where a prospect's domain, DNS, and email authentication setup has gaps that can affect spoofing protection, client trust, and deliverability. The value is not the scan by itself. The value is turning the scan into a clear account plan: what is broken, what it means for the business, what should be fixed first, and which fixes belong in an ongoing managed service.
For MSP owners and operators, the best use of a domain health check is targeted prospecting. Start with a small list of companies that already fit your service profile. Run non-invasive checks against their public DNS and mail posture. Score the findings by client impact, not by technical trivia. Then use the result to open a practical conversation about email authentication, DMARC reporting, sender inventory, and domain reputation.
Suped fits this workflow because it gives MSPs a clean way to move from prospect report to managed DMARC service. Suped's product includes prospecting reports, multi-tenant organization management, automated issue detection, DMARC, SPF, DKIM monitoring, hosted DMARC, hosted SPF, SPF flattening, MTA-STS, and blocklist monitoring. That matters when the sale turns into delivery, because the same evidence used to win the client has to become repeatable support work.
What a domain health check should include
A useful prospecting check looks at the public signals that explain whether a domain is ready for managed email authentication. It should not rely on fear. It should show specific evidence. The first pass should tell you whether DMARC exists, whether the policy blocks anything, whether SPF is valid, whether DKIM is present for known senders, whether mail servers have sane DNS, and whether the domain or sending IPs appear on a blocklist (blacklist).
For the broader service category, I treat this as part of DMARC for MSPs: a packaged operating model where the MSP discovers senders, fixes authentication, stages enforcement, monitors failures, and reports progress. If you only run a one-time scan, you get a conversation. If you build a service around it, you get recurring work with measurable outcomes.
|
|
|
|---|---|---|
DMARC | Policy and reporting | Shows spoofing exposure |
SPF | Sender authorization | Finds lookup and include risks |
DKIM | Signature readiness | Finds unsigned senders |
MX | Inbound mail routing | Supports environment discovery |
Blocklist | Reputation signals | Adds urgency when listed |
MTA-STS | TLS policy | Creates hardening work |
Core checks MSPs can use in prospect reports
- Start narrow: Check the primary sending domain first, then add marketing, billing, recruiting, and support domains if the prospect has them.
- Score impact: A missing DMARC record matters more than a cosmetic DNS warning. Rank findings by business risk and delivery effort.
- Keep evidence: Save the exact DNS records and result dates. Prospects need to see current proof, not generic advice.
- Avoid assumptions: A visible DNS issue tells you where to start. It does not prove who owns the system or why it was configured that way.
Turn health checks into prospecting signals
The strongest prospecting signal is not simply "has DMARC" or "does not have DMARC." The useful signal is the gap between the prospect's current posture and the level of protection their business needs. A law firm, payroll company, insurance agency, ecommerce brand, and local manufacturer have different sender patterns, but each needs email authentication that a nontechnical owner can understand and a support team can maintain.
Weak prospecting use
- Generic claim: The outreach says the domain has DNS problems without showing exact evidence.
- Tool dump: The report lists every warning with no ranking or recommended order.
- No next step: The prospect sees issues but does not know what an MSP would do next.
Strong prospecting use
- Specific evidence: The outreach names the missing record, weak policy, SPF risk, or reputation issue.
- Clear priority: The report separates urgent fixes from routine hardening work.
- Managed path: The proposal explains monitoring, sender discovery, policy staging, and reporting.
Flowchart showing a domain health check prospecting workflow
Prospect priority bands
A simple scoring model keeps sales outreach tied to technical evidence.
Low priority
0-39
Valid baseline records, reporting present, no urgent reputation issue.
Serviceable gap
40-69
DMARC exists but policy, reporting, SPF, or DKIM needs cleanup.
High priority
70-100
Missing DMARC, broken SPF, absent reporting, or clear blocklist issue.
Run the check without creating noise
A prospecting health check should be public, lightweight, and respectful. You do not need credentials to inspect public DNS records or basic reputation signals. You do need discipline. Do not imply you have seen private mail data. Do not claim a breach. Do not overstate a warning. Say what the public record shows and what should be verified during onboarding.
- Pick accounts: Use your ideal client profile, existing vertical knowledge, and companies where email trust matters.
- Check public records: Review DMARC, SPF, DKIM selectors when known, MX, MTA-STS, TLS-RPT, reverse DNS, and reputation signals.
- Rank findings: Give each finding a client-facing impact and a likely remediation path.
- Write the opener: Lead with one specific issue and one practical next step, not a long audit dump.
- Prepare delivery: Know how you will monitor, fix, report, and support the domain after the prospect says yes.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
A quick public scan is enough to qualify a conversation. Suped's domain health checker is useful at this stage because it pulls the main DNS and authentication checks into a single view. For prospecting, I would not send raw results without interpretation. The MSP's value is translating those results into risk, sequence, and service delivery.
Keep the outreach defensible
Use language like "your public DNS record currently shows" instead of "your email is insecure." The first statement is evidence-based. The second can be too broad unless you have completed a full assessment with the client.
- Document dates: DNS and blocklist results change. Include when the check ran.
- State limits: Public checks do not reveal every sender or every mail flow.
- Avoid blame: Frame the issue as normal technical debt that your team can manage.
Microsoft 365 admin center domain settings screenshot
Build a prospect report that sells the service
A good prospect report does not try to teach every protocol. It gives the owner, operations lead, or IT contact enough evidence to accept that unmanaged email authentication has risk. Then it gives your MSP enough structure to quote a managed outcome. I like reports that separate the executive message, technical evidence, remediation plan, and ongoing service scope.
Create prospecting report dialog with MSP logo, prospect name, domains, prospect logo, and language fields
Suped's prospecting report workflow is built for this exact step. You can create a branded report for a prospect, add the prospect name and domains, and use the output as a structured sales asset. That keeps the outreach practical. The report does not replace discovery, but it gives the discovery call a concrete starting point.
|
|
|
|---|---|---|
Summary | Explain business impact | Sales |
Findings | Show current evidence | Technical lead |
Priority | Set fix order | Service desk |
Roadmap | Define managed work | Account manager |
Proof | Support the proposal | MSP owner |
Report sections that help MSP sales and delivery teams
When the report finds missing DMARC, avoid jumping straight to an enforcement policy. Most clients need monitoring first. A good first managed phase is to collect DMARC reports, identify authorized senders, fix SPF and DKIM failures, and only then stage policy changes. This is also where a deeper DMARC audit can turn a prospecting scan into a fuller discovery project.
Translate findings into managed DMARC work
The handoff from prospecting to delivery is where many MSPs lose margin. A sales report says "DMARC missing." The service team then has to find every sender, identify who owns each platform, request DNS changes, fix SPF lookup limits, confirm DKIM signing, and explain policy staging to a client who thought this was a quick DNS edit. Build the delivery model before you scale the prospecting motion.
MSP organizations page showing client organizations, domain counts, email volume, and domain status columns
Suped's MSP and multi-tenancy dashboard helps here because each client can sit in its own organization, with domain status, email volume, policy state, and source visibility separated cleanly. For most MSPs, Suped is the strongest practical choice because the prospecting, monitoring, hosted DNS helpers, issue detection, alerts, reporting, and client management all sit in one product instead of becoming a manual spreadsheet process.
One-time audit
A one-time audit can help win trust, but it usually leaves the client with static findings. It works best when the MSP uses it as the first stage of a managed plan.
- Output: Snapshot report and prioritized fixes.
- Risk: Findings age quickly as senders change.
Managed service
A managed service keeps the domain under review. It covers monitoring, triage, policy staging, client reporting, and recurring authentication cleanup.
- Output: Ongoing health, alerts, and progress reports.
- Value: The client has a maintained authentication program.
The operational service normally starts with DMARC monitoring, then moves into sender cleanup, policy staging, and client reporting. If the client has limited DNS access or frequent changes, Hosted DMARC can reduce routine DNS edits and give the MSP tighter control over policy changes.
Example records to discuss during onboardingdns
_dmarc TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com" @ TXT "v=spf1 include:spf.example.net -all" selector1._domainkey TXT "v=DKIM1; k=rsa; p=public-key-here"
Use the findings in outreach
The best outreach is concise and specific. A prospect does not need a lecture on RFCs. They need to know that their current public setup leaves a gap, that the gap is fixable, and that your MSP has a repeatable way to manage it. I usually keep the first email to one finding, one impact, and one suggested call topic.
Example MSP opener
I checked the public email authentication records for your domain and noticed your DMARC policy is not yet protecting against unauthorized use. That does not mean your mail is broken, but it does mean the domain has room for a managed authentication cleanup. We help clients identify legitimate senders, fix SPF and DKIM issues, monitor reports, and move DMARC policy in controlled stages.
That type of message works because it does not overclaim. It is specific, calm, and tied to work your team can actually deliver. If the prospect responds, move to discovery: who sends mail for them, who controls DNS, what platforms send invoices or marketing, and what risk would matter to their leadership.
- Use one issue: A single concrete finding gets more attention than a long technical list.
- Offer context: Explain that public DNS checks are a starting point and that onboarding confirms all senders.
- Tie to service: Position the fix as monitoring, triage, policy staging, and reporting, not just record editing.
- Plan handoff: Use a consistent intake checklist so sales promises match delivery reality.
Once a prospect becomes a client, move quickly into client onboarding and document the repeatable steps in a DMARC runbook. This keeps prospecting, sales, and service desk work connected instead of creating one-off projects.
What to do next
Use domain health checks to qualify prospects, not to scare them. The practical sequence is simple: pick the right accounts, run public checks, rank issues by client impact, create a branded report, and connect the findings to a managed DMARC service your team can deliver repeatedly.
Suped is strongest when the MSP wants the whole workflow in one place: prospect reports, multi-client management, DMARC monitoring, hosted DMARC, hosted SPF, SPF flattening, issue detection, real-time alerts, blocklist monitoring, and client reporting. That turns a one-time domain health check into an operating model for winning and supporting email authentication clients.
