MSP email security guides

Email how-tos

• DMARC p=none: what it means, the risks, and how to move to quarantine and reject

  DMARC p=none only monitors. Learn the real risk, how rua and ruf reports work, what changed with pct in RFC 9989, and a safe path to quarantine and reject.

• SPF "too many DNS lookups" (permerror): the 10-lookup limit and how to fix it

  Why SPF hits permerror past 10 DNS lookups or 2 void lookups (RFC 7208), how to count them, and fixes: drop unused includes, use subdomains, flatten.

• SPF for Microsoft 365: using include:spf.protection.outlook.com correctly

  The correct Microsoft 365 SPF record, when to use -all, GCC High and 21Vianet variants, merging other senders into one record, and why not to flatten it.

• SPF for Google Workspace: setting up include:_spf.google.com the right way

  The Google Workspace SPF record, merging other senders into one TXT record, ~all vs -all, the 10-lookup limit, and the DKIM and DMARC steps that come next.

• SPF for Zoho Mail: the right include for your data center

  The Zoho Mail SPF include, why the value can depend on your Zoho data center, include:one.zoho.com for multiple Zoho apps, and merging into one record.

• Cyber insurance email controls: what applications ask and how MSPs can help clients answer

  What cyber insurance applications commonly ask about email security (MFA, DMARC, SPF, DKIM, filtering), quoted from insurer forms, and how MSPs can help.

• Amazon SES and SPF: where include:amazonses.com actually goes

  Why include:amazonses.com goes on a custom MAIL FROM subdomain, not your apex, plus the MX record SES needs and how SPF and DKIM align for DMARC.

• At-Bay's cyber short application: what it asks about email, question by question

  What At-Bay's Cyber Short Application (AB-CYB-SAP 06/2026) asks about email: domains, MFA on all email access, and an optional email gateway question.

• Beazley's ransomware supplement: what it asks about email, and how to answer accurately

  What Beazley's ransomware supplemental form F00765 (052022 ed.) asks about incoming email, DKIM, SPF, DMARC, web email MFA and legacy protocols, for MSPs.

• Chubb Australia's cyber proposal form (11/2023): what it asks about email and MFA

  What Chubb Australia's Short MarketPlace Cyber Proposal Form (Published 11/2023) asks about email security and MFA, and how MSPs can help clients answer.

• Corvus Smart Cyber application: the email questions, and how MSPs can answer them

  What the Corvus Smart Cyber Insurance Application (Version 3.2, September 2024) asks about email filtering, secure email gateways, MFA and payment checks.

• DKIM "body hash did not verify": finding what changed the message body

  'Body hash did not verify' means the body changed after signing. Usual culprits: footers, disclaimers, lists, re-encoding. How to find the hop and fix it.

• DKIM "signature did not verify": what failed and where to look

  What 'DKIM signature verification failed' means under RFC 6376, how it differs from a body hash failure, and the key, DNS and header causes to check first.

• DMARC fail with SPF and DKIM passing: fixing "not aligned"

  Why mail fails DMARC when SPF and DKIM both pass: identifier alignment under RFC 9989, how to read the headers, and the usual fixes for SaaS senders.

• DMARC p=quarantine: what it means and how to roll it out safely

  What DMARC p=quarantine asks receivers to do, how it differs from none and reject, testing with t=y under RFC 9989 (pct is historic), and a safe rollout.

• HubSpot SPF: adding HubSpot's include when you connect a sending domain

  HubSpot generates an account-specific SPF include, two DKIM CNAMEs, an MX and a DMARC record. Where each goes, how to merge SPF, and what to verify.

• Mailchimp and Mandrill SPF: why the current docs don't ask for an include

  Mailchimp's current setup asks for 2 DKIM CNAMEs and a DMARC record, not an SPF include. Mandrill's DKIM CNAMEs and custom return-path, explained.

• Mailgun SPF: setting up include:mailgun.org without breaking the lookup limit

  Mailgun's documented SPF record, where it goes, the DKIM, MX and tracking records beside it, and why include:mailgun.org costs more lookups than it looks.

• Mimecast SPF: choosing the right regional include for outbound mail

  Which Mimecast SPF include to use by region, why the global _netblocks include costs extra lookups, the newer mimecastprotect.com records, and the mx trap.

• "No DMARC record found": causes, what receivers do, and the record to publish

  Why a checker says 'no DMARC record found': missing _dmarc TXT, duplicate records, bad v= tag, or a DNS error. What RFC 9989 says, and a safe first record.

• Postmark SPF: the custom Return-Path replaces the include

  Postmark says you no longer need it in your SPF record. Here's the custom Return-Path CNAME that gives aligned SPF, and why include:spf.mtasv.net won't.

• Proofpoint Essentials SPF: what to add when outbound mail relays through Proofpoint

  Proofpoint Essentials SPF for outbound relay: the a:dispatch-us entry in Proofpoint's guides, the newer _spf-us include in live DNS, and how to merge them.

• QuickBooks Online and SPF: there's no include to add, so here's what to check

  QuickBooks Online sends invoices via Intuit or a connected Gmail account. Intuit documents no SPF include. What to check, and why not include:intuit.com.

• Salesforce SPF: include:_spf.salesforce.com, and why DMARC still needs DKIM

  Salesforce's documented SPF entry is include:_spf.salesforce.com, but default bounce settings stop SPF aligning. Why DKIM is Salesforce's preferred fix.

• SendGrid SPF: do you need include:sendgrid.net?

  When SendGrid needs include:sendgrid.net and when its CNAMEs handle SPF for you, where the record goes, and how it aligns for DMARC. Per Twilio docs.

• SPF permerror: multiple SPF records, syntax errors, and the other causes

  SPF permerror beyond the lookup limit: two v=spf1 records, syntax typos, bad ip4 ranges, dead includes, duplicate redirects. What RFC 7208 says, and fixes.

• SPF softfail vs fail: what ~all and -all really change

  SPF softfail (~all) vs fail (-all) per RFC 7208: what each result tells a receiver, how DMARC treats them, why -all can bypass DMARC, and which to pick.

• Travelers' MFA supplement: the email and admin questions MSPs end up answering

  What the Travelers Multi-Factor Authentication Supplement, CYB-14306 Rev. 03-23, asks about email and admin MFA, how answers work, and how MSPs can prep.

• Zendesk SPF: setting up include:mail.zendesk.com the way Zendesk checks it

  Zendesk's recommended SPF record, the first-layer rule, outdated includes to replace, and the DKIM CNAMEs that let support mail pass DMARC.

Playbook weeks 1–4

From The First 90 Days. Each week is 3–5 hours.

• Week 1 — Look the part

  Week 1 of The First 90 Days, a free MSP security playbook: scan and fix your own domain, brand every template, and build a short menu you can deliver.

• Week 2 — Baseline your existing clients

  Week 2 of The First 90 Days: run the same external check on every client domain, sort by verified fails, and send each client a short, no-pressure report.

• Week 3 — Build a prospect list

  Week 3 of The First 90 Days: list 25–50 local businesses, check each with public data, rank by the work the findings open up, and pick your top 10.

• Week 4 — Send short security briefs and follow up fast

  Week 4 of The First 90 Days: send your top 10 prospects a one-page brief, call the day they open it, and start 2–3 clients on insurance renewal prep.