Week 2 of the MSP security playbook: baseline your existing clients

Week 2 of The First 90 Days, Client Posture's free playbook for MSPs building a security practice, is the one the playbook page publishes as a sample. That means we can tell you exactly what it says. The instructions are three lines long:

> - Run the same external check on every client domain.

> - Sort the results by verified fails. Those are your first paid fixes.

> - Send each client their report with a short, no-pressure note. Don't sell yet. Just show up with something useful.

It sits in the Days 1–30 phase ("Set up and baseline your clients and prospects"), after week 1's brand and menu work and before week 3's prospect list. Below, we unpack each line with practical notes. The notes are ours, not the PDF's.

1. Run the same external check on every client domain

The important word is same. A baseline is only useful if every client is measured the same way. That way you can compare clients with each other, and later compare a client with themselves at the next QBR.

Practical points:

• List every domain, not just the primary one. Many clients have a second domain from a rebrand, an acquisition, or a parked name. Parked domains that never send mail should still have protective SPF and DMARC records. Microsoft, for example, documents v=spf1 -all and v=DMARC1; p=reject; for them.
• Stick to public information. An external baseline means DNS records, certificates, and what anyone can see. It doesn't need logins or agents, so you can run it this week without change tickets.
• Record the date. DNS changes. A baseline is a snapshot, and the date is what makes it useful later.

For email, the core checks are usually SPF (one record, no more than 10 DNS lookups), DKIM (a published key at the selectors you know the client uses), DMARC (the policy and whether reports go anywhere), and MX.

2. Sort by verified fails

This is the step that keeps you honest, and it ties back to the playbook's "one rule": never put a claim in front of a client that you can't back up.

Separate your results into three groups:

• Verified fails. The check confirmed a problem. Two SPF records at the same name is a verified permerror under RFC 7208. A DMARC record at p=none is verifiably monitor-only.
• Warnings. It works, but it's weaker than it could be. For example, a 1024-bit DKIM key, or SPF ending in ~all on a Microsoft 365 domain with no custom-domain DKIM (Microsoft recommends -all; Google recommends ~all for Workspace, so don't flag that one).
• Unknowns. The check couldn't confirm either way. A DKIM lookup that finds nothing at common selectors is the classic case. Selectors aren't listed in DNS, so a miss doesn't prove DKIM is missing.

The playbook's point is that verified fails are your first paid fixes. They're concrete, explainable, and defensible. Unknowns are questions to raise with the client's admin, not findings to bill for.

3. Send each client their report with a short, no-pressure note

"Don't sell yet. Just show up with something useful." This is relationship work. Most clients have never had their MSP proactively show them their own security posture. A short, friendly note with a clear report earns you the conversation in later weeks.

Our suggestions for the note (the PDF includes its own client baseline email script):

• Keep it short: what you checked, why, and the one or two things that matter most.
• Mention what's working, not just the gaps.
• Leave the door open without a pitch: "Happy to walk through it if useful."
• Don't use fear language and don't overclaim. If something is unknown, say so.

How this sets up the rest of the 90 days

Your baseline feeds directly into later weeks. Week 5 packages a paid assessment. Week 6 turns findings into proposals. Week 9 runs your first QBRs. A dated week 2 baseline is what lets you show progress at that QBR.

Where Client Posture fits this week

You can run week 2 with free tools and a spreadsheet. If you'd rather not, the playbook names what Client Posture does here: bulk-import client domains by CSV, scan them all at once, and export findings to CSV for tickets or SOWs.

A few specifics from Client Posture's site:

• Every check is passive: DNS, certificate transparency logs, domain registration, and one normal homepage visit. There are no port scans, login attempts, or vulnerability probes.
• A fail is shown only when it's verified. Anything that can't be confirmed shows as Unknown or Not tested.
• Bulk CSV import and export are on every plan. How many client domains you can add depends on the plan: Free has 1, Starter 25, Founding Partner 50, and Pro 150.

Week 2 checklist

• Every client domain is listed, including secondary and parked domains.
• The same external check has been run on all of them, with the date recorded.
• Results are sorted into verified fails, warnings, and unknowns.
• Each client has received a short, no-pressure note with their report.
• Verified fails are noted as candidate fixes for weeks 5 and 6.

Start your baseline

Grade a client domain's email security free →

One transparent grade from verified SPF, DKIM, DMARC, and MX checks, with points shown per check, the top three verified fixes, and Unknowns listed separately at no cost.

Get the free 90-day playbook (12-page PDF) →

Founding Partner: $1,999, one time. Baseline up to 50 client domains in one pass, with branded reports, weekly rescans, and change alerts so the baseline stays current. Founding Partner also includes unlimited Security Briefs (150 prospect scans a month), the Grow toolkit, the Policy library, a branded service menu, webhooks, the API, and MCP access (except quote drafts). If you later subscribe to Pro, you pay $299/mo instead of $399 for as long as that Pro subscription stays active. The offer is capped at 50 seats and closes on Dec 15, 2026, or when all 50 seats are claimed, whichever comes first. Proposals and the Service Library require Pro. Founding Partner is non-refundable, except that you're refunded if the seats run out before your payment can be fulfilled.

See Founding Partner details →