Why MSPs Should Not Ignore Client Email Authentication

Introduction

Every client domain an MSP manages is currently in one of two states: protected by DMARC, or spoofable by anyone. If you're not actively managing client email authentication, you're allowing the second state — and inheriting the support tickets when it manifests.

Why this topic matters

MSPs that ignore email authentication carry hidden risk: when a client's customer gets phished using the client's brand, the support call lands on the MSP. Adding DMARC services closes the vulnerability and converts the risk into revenue.

The risk of inaction

Three concrete consequences of letting client domains stay unprotected:

Phishing incidents. A spoofed email from a client domain causes a breach. The client calls you — you didn't configure their email authentication. The conversation is uncomfortable.
Deliverability complaints. Marketing email stops reaching inboxes; the client blames "their email setup" — which is you.
Insurance and compliance failures. A client fails a cyber-insurance audit; the gap is DMARC; you should have caught it.

Each is preventable. The prevention is the service.

The opportunity

Two angles, depending on your relationship with each client:

Defensive: Add DMARC quietly as part of the managed-services baseline. Bills justified by "we keep your email working."
Offensive: Pitch DMARC as a new SKU. Selling motion, audit, three-tier offering.

Both work. The offensive approach captures more revenue; the defensive approach lowers your support load.

Step-by-step approach

Audit your client base. Which domains are at p=reject, which at p=none, which have no DMARC at all.
Tier the risk. Prioritize high-volume senders and high-trust client verticals.
Roll out to existing clients. Even quietly, even bundled.
Add to new-client onboarding. Default deliverable.
Document the work as part of your value story.

Best practices

Don't wait for incidents to act. The reactive conversation is worse than the proactive one.
Productize the offering. Three tiers, three SKUs.
Track client posture as a metric. Internal dashboard of who's at what policy.
Renew on results. Annual review showing the improvement supports retention.
Don't let competitors get there first. DMARC services are growing fast.

Recommended next step

Audit your top 10 client domains this week. Each one at p=none or no policy is risk and revenue opportunity in equal measure.

FAQ

What if a client doesn't want DMARC?

Document the conversation. If they push back on a service they need, ensure the no is on the record.

Can I add DMARC to managed services without a SOW change?

If your master agreement covers "general email administration," yes. If it specifies exact services, amend.

What if a client already has DMARC?

Audit the implementation. Most are at p=none and stalled. The opportunity is the rollout to enforcement.

How do I price this for existing managed-services clients?

Either as a separate SKU or as a service-quality improvement at no additional charge. The latter strengthens retention.

What's the worst-case scenario if I don't act?

A spoofed-email incident at a client triggers a breach, and the post-mortem identifies DMARC as the missing control. Hard to recover the relationship.

Final thoughts

Ignoring client email authentication is one of the few MSP risks that's both technical and commercial. The fix is bounded; the consequences of inaction compound.

Don't be the MSP that finds out the hard way.