MSP lead generation without ads: a practical guide for small MSPs

Most small MSPs get their first ten clients from people they already know. The next ten are harder. Ads are expensive for local B2B services, cold calling is draining, and generic emails ("we provide managed IT services") get deleted. This guide sets out a system that works without an ad budget: a narrow niche, a hand-built list, an opening based on something real, follow-ups triggered by events, and a simple way to measure it.

1. Pick a niche you can talk about

"Small businesses" is not a niche. "Dental practices within 30 miles", "accounting firms with 5 to 25 staff" or "law firms that use Microsoft 365" are. A niche helps in three ways:

• Your message gets sharper. You can mention the practice-management software they use, the season when they are busiest, or the rules they worry about.
• Referrals compound. Practice managers talk to each other. One happy dental client makes the next dental conversation easier.
• Your services get repeatable. The same onboarding checklist, the same email security rollout, the same pricing.

Start with the vertical where you already have a client or two. If you have none, pick one with a clear reason to care about email: anyone who sends invoices, handles client money or receives sensitive documents by email.

2. Build a list by hand

A good list is 50 to 200 businesses you would genuinely like as clients. Sources that cost nothing:

• Local professional associations and chambers of commerce, which often publish member directories.
• Map listings for your niche and area. The website field is all you need to start.
• Your own network: suppliers, accountants and web designers who already serve your niche.
• Businesses that visibly use tools you support, such as a "Book online" button from a platform you know.

For each business keep the website, the decision maker's name and role (owner, practice manager, office manager), and a note on how you found them. A spreadsheet is enough.

3. Open with something specific and true

The single biggest improvement to cold outreach is replacing a pitch with an observation. "We help businesses like yours with IT" is a pitch. "Anyone can currently send email that appears to come from @yourpractice.com" is an observation the reader can check, and it is about them.

Public email and website settings are the best source of observations, because they are:

• Common. In our check of 64 local firms, 64% had no DMARC record at all.
• Explainable in one sentence to someone who is not technical.
• Public. You read them the same way any mail server or browser does, so mentioning them is not intrusive.
• Fixable. Each one is a small, scoped project, which makes the first "yes" easy.

This is what a passive check does. Run your list through one (a bulk check handles 50 at a time on the Solo plan), sort by grade, and start with the businesses that have the clearest, most explainable gap. What you can check before a prospect says yes explains exactly what is and is not in scope.

4. Write the first message

Keep it short, specific and easy to answer:

1. Who you are and that you work with businesses like theirs, in one line.
2. The one or two things you noticed, in plain language, with why it matters to the business.
3. A link to a one-page summary they can read or forward.
4. A small ask: "Would a 15-minute walkthrough be useful?"

Avoid fear. Never say a business has been hacked or breached because of what you found in public DNS. Say what is visible and what fixing it gives them. The cold email templates post has five versions you can adapt, and selling cybersecurity without scare tactics covers tone.

Send from your real business domain, with SPF, DKIM and DMARC set up properly. Pointing out a prospect's DMARC gap from a domain without DMARC undermines the whole message.

5. Follow up when there is a reason

Most replies come after the first message, not from it. But "just checking in" adds nothing. A better follow-up has news:

• Their SSL certificate is now under 14 days from expiry.
• Their domain registration is coming up for renewal.
• They changed mail provider, which is the moment SPF and DKIM most often break.
• A new gap appeared, or one they had was fixed (a natural, positive reason to get in touch).

Watching domains weekly turns these events into alerts. Follow-up triggers for MSP sales lists each trigger with a sample message.

6. Add channels that compound

• Referral partners. Accountants, web designers and office-equipment suppliers meet your prospects first. Offer to check their clients' domains for free and send them the reports to pass on.
• Local talks. A 20-minute session at a chamber or association meeting on "how to stop fake invoices in your name" fills a room more easily than "IT services". Bring anonymised, aggregate numbers from your own checks.
• Useful content. A short page on your site answering the questions your niche actually asks, for example what DMARC is in plain English, gives prospects something to forward internally.
• Existing clients. Re-check their domains each quarter and show what improved. It is the cheapest way to earn a referral.

7. Measure a few numbers

You do not need a CRM to start. Track, per week:

If replies are low, change the observation or the niche. If meetings are low, make the ask smaller. If projects are low, look at the offer, not the outreach.

8. Stay legal and polite

Business email outreach is regulated differently by country. In the US, CAN-SPAM requires an accurate sender, a non-deceptive subject, a physical address and a working opt-out. In the UK and EU, PECR and GDPR apply, and sole traders and some partnerships are treated as individuals. Keep messages one-to-one and relevant, stop when asked, and take advice if you are unsure. Our acceptable use policy sets the same expectations for reports sent with Hookgap.

A one-page checklist

1. One niche, one area, one list of 50 to 200 businesses.
2. A passive check of every domain, sorted by the clearest gap.
3. A short, specific first message with a one-page report.
4. Weekly domain watching and event-based follow-ups.
5. Two referral partners and one local talk per quarter.
6. Four numbers, reviewed every Friday.

If you are choosing software to produce the reports, choosing a security prospecting report tool compares the options fairly.