MSP cold email templates that open with a real security gap

A cold email from an MSP has about three seconds to show it is about the reader, not the sender. The templates below all do the same thing: name one specific, public, fixable gap, say why it matters in business terms, and ask for something small. Each is written to be adapted, not pasted. Replace everything in [brackets].

The rules behind every template

• One observation, stated plainly. Not a list of twelve findings.
• Business impact, not jargon. "Fake invoices can be sent in your name" beats "you lack a DMARC policy".
• No fear words. Never "hacked", "breached" or "vulnerable". You looked at public settings; say that.
• A small ask. A 15-minute walkthrough or a yes/no question.
• Your own email set up correctly. Send from a domain with SPF, DKIM and an enforced DMARC policy.

1. No DMARC record

Subject: Email in [Company]'s name

Hi [first name],

I'm [your name] at [your MSP], we look after IT for [niche] firms in [area].

I ran a quick check of [domain]'s public email settings and noticed there's no DMARC record. In plain terms: email providers have no instructions to block messages that pretend to come from @[domain], such as fake invoices to your clients.

Here's a one-page summary: [report link]

It's usually a quick fix. Would a 15-minute walkthrough be useful?

[your name]

Why it works: it is the most common gap and the easiest to picture. If the reader asks "is that serious?", how to explain DMARC in two minutes has the answer ready.

2. SSL certificate expiring soon

Subject: [domain] certificate expires [date]

Hi [first name],

Quick heads-up: the security certificate on [domain] expires on [date]. If it isn't renewed, visitors will see a "Your connection is not private" warning instead of your site.

If your web provider renews it automatically, you can ignore this. If you're not sure, here's what I found: [report link]

Happy to check it's handled.

[your name], [your MSP]

Why it works: a date creates urgency without exaggeration, and the email is useful even if they never hire you. Certificates are getting shorter-lived, so this comes up more often: see SSL certificates are moving to 47 days.

3. SPF record over the lookup limit

Subject: [Company]'s email authentication

Hi [first name],

I noticed [domain]'s SPF record (the list of services allowed to send your email) needs [n] DNS lookups. The limit is 10, so receiving servers stop checking and treat it as a failure. That can quietly push real emails to spam.

This usually happens one tool at a time: a CRM, a newsletter, a booking system. Summary here: [report link]

Want me to show you which entries can go?

[your name]

Why it works: it explains a problem they may already feel ("our emails go to spam") and gives the cause. Check the number first with the SPF lookup counter.

4. They just changed mail provider

Subject: After the move to [Microsoft 365 / Google Workspace]

Hi [first name],

It looks like [Company] recently moved email to [provider]. Congratulations, it's a good platform.

Moves like this are when email authentication most often gets left half done. On [domain], [specific finding, e.g. DKIM signing isn't on yet for the new provider].

Summary: [report link]. Happy to help finish the job.

[your name]

Why it works: it is timely and complimentary. You only know about the move if you watch the domain, which is what follow-up triggers are for.

5. Website without basic protections

Subject: [domain] security settings

Hi [first name],

Your website loads fine, but it's missing a few standard browser protections, for example it doesn't tell browsers to always use the secure version of the site.

None of this means anything is wrong today. It's the website equivalent of locking the door. Details: [report link]

It's normally under an hour of work. Worth a quick call?

[your name]

Why it works: it is honest about severity, which builds trust. For the technical background, see website security headers explained.

Mistakes that get MSP emails ignored

• Leading with your company. The first sentence should be about them.
• Attaching a 20-page audit. Nobody reads it. One page, one link.
• Inventing urgency. If a gap is low severity, say so. Overselling one finding costs you credibility on the next.
• Sending from a misconfigured domain. Check your own domain before you check theirs.
• Ignoring the law. Include who you are and a way to opt out, and follow CAN-SPAM, GDPR or PECR as they apply to you.

Where the words come from in Hookgap

Every Hookgap report on a paid plan includes an outreach kit: an email, a LinkedIn note and a 60-second Loom script, filled from the report's top findings. They follow the rules above and are written from reviewed templates, not generated text, so they never claim something the report did not find. Open the sample report to see the findings they are built from.