Skip to content
Hookgap
Get started

How MSPs use DMARC gaps to book first meetings (with templates)

· 7 min read

Cold outreach without a reason gets ignored. "We provide managed IT services" is a pitch; "anyone can currently send email pretending to be @yourfirm.com" is a reason. DMARC gaps are the most common, most explainable reason a small business has to talk to you this week.

Why DMARC is the best opener

  • It is common. In our own check of 64 law, dental and accounting firms in one US city, 41 had no DMARC record at all and only 8 enforced it. You will rarely run out of prospects.
  • It is easy to explain. No jargon needed: "Fake invoices can be sent in your name, and your real email is more likely to land in spam."
  • It is public. DMARC lives in DNS. Checking it is the same lookup every mail server in the world does, so there is nothing intrusive about mentioning it.
  • It leads to paid work. Moving a domain from no DMARC to p=reject safely means finding every legitimate sender, fixing SPF and DKIM, and monitoring reports. That is a project, and often a monthly service.

The three states you will find

  1. No DMARC record. Mail providers have no instructions for fake email using the domain. This is your strongest opener.
  2. DMARC with p=none. Someone started the job and stopped. Spoofed email is still delivered. Great follow-up: "you are halfway there".
  3. p=quarantine or p=reject. Protected. Look at the rest of the report instead: SPF over the 10-lookup limit, an expiring certificate, or missing MTA-STS.

Not sure what the policies mean? Read DMARC p=none vs quarantine vs reject, in plain English.

A weekly routine that fits around client work

  1. Build a list of 20–50 local businesses in one vertical you already serve (dental, legal, accounting, property management). Their websites are enough.
  2. Run them through a bulk check and sort by grade. Start with the D and F results that are missing DMARC.
  3. Find the decision maker: practice manager, office manager or owner. LinkedIn and the firm's "About" page usually name them.
  4. Send something useful, not a pitch. A one-page report with your name on it, the top one or two findings in plain English, and a short ask.
  5. Watch the domain. If they do not reply, a later change (a certificate about to expire, a new gap) is a natural reason to follow up.

Email template

Subject: Quick question about yourfirm.com

Hi [first name],

I'm [name] at [MSP]. We look after IT for [vertical] firms in [city]. I ran a quick passive check of yourfirm.com's public email setup and noticed there is no DMARC record, which means anyone can send email that looks like it came from you.

Here's a one-page summary in plain English: [report link]

It's usually a short project to fix safely. Would a 15-minute call next week be useful?

[name]

Keep it this short. One finding, one link, one question. If there is a second strong finding (an SSL certificate expiring in under two weeks, for example), add one sentence for it and stop there.

60-second Loom script

  1. 0–10s: "Hi [name], this is [you] from [MSP]. I made this for [firm] specifically."
  2. 10–35s: Show the report. "Your grade is F. The main thing: there's no DMARC record, so fake invoices can be sent as @yourfirm.com."
  3. 35–50s: "Everything here is from public data. Nothing was accessed. Most of it is a quick fix."
  4. 50–60s: "If it's useful, reply or book 15 minutes with the link below."

What not to say

  • Do not say they have been hacked or breached. A missing record is a gap, not an incident.
  • Do not attach PDFs to a first cold email. A link gets through filters; an attachment from a stranger often does not.
  • Do not promise to "fix it today". Moving to p=reject without checking who sends mail for the domain can block real email. That caution is exactly why they need you.
  • Follow the email rules that apply to you (CAN-SPAM in the US, GDPR and PECR in the UK and EU): identify yourself, and stop when asked.

Turning the meeting into work

On the call, walk through the report top to bottom and agree a scope: publish DMARC at p=none with reporting, inventory senders for two to four weeks, fix SPF and DKIM, then step up to quarantine and reject. Offer ongoing monitoring as a monthly line item, and add the domain to your watchlist so you see if anything regresses.

Keep reading