Walk into Tuesday’s client meeting with this.
Not a page describing a toolkit — the actual words. The pitch in three lengths, the five objections your client will raise and how to answer each, and a calculator that prices your cost accurately so you can set a retail number you can defend.
Whichever one fits the room.
Written to be used verbatim and edited freely. Nothing here mentions us — it is your service, sold in your voice.
Right now anyone can send an email that looks exactly like it came from your domain — same address, same display name. Your customers cannot tell the difference, and neither can their spam filter.
There is one DNS record that fixes it. We publish it, watch who is sending as you for a few weeks, and then switch it to blocking. After that, forged mail using your name gets refused before it reaches anyone.
It costs less than one hour of my time per month, and I can show you where you stand today in about thirty seconds.
No protocol names, no acronyms, and a concrete close that leads straight into running the free check on their domain in front of them. The last line is the whole pitch — a demonstration beats a description.
“Can I show you something about your domain? It takes thirty seconds and it is public.” Then run the checker in front of them. Their own failing record is a better argument than anything you can say.
Five objections, and the trap in each.
The traps matter more than the answers. Every one of them is a place where the persuasive thing to say is the thing that costs you the account in month three.
Microsoft protects the mail arriving in your inbox, and it does that well. This is the opposite direction: stopping someone else sending mail that claims to be from you, to your customers and suppliers. Microsoft cannot do that for you because the message never touches their systems — it is a claim made about your domain, out on the internet, and only a record you publish can refuse it.
Saying Microsoft’s protection is inadequate. It is not, for what it does, and the client may well have paid extra for it. Position this as a different problem, not a better product.
This objection is the one worth rehearsing. Get the inbound-versus-outbound distinction crisp and the rest of the meeting is easier.
You would not necessarily know. The fraud lands in your customer’s inbox, not yours, and the person who gets caught usually blames themselves instead of telling you. That is exactly what the first 2 weeks of reporting answers — if nobody is sending as you, the reports will show that and you will have paid for a month of monitoring to find out. If someone is, you will see where from and how much.
Implying they have definitely been spoofed. You do not know that yet, and a scare claim you cannot evidence damages you when the first report comes back clean.
Framing the pilot as a test that might exonerate them is more persuasive than certainty. It also protects you if the data is unexciting.
At the setting we start with, no — it is monitor-only, and receiving servers treat your mail exactly as they did yesterday. The step that can affect delivery is moving to blocking later, and we do not take it until the reports show every legitimate sender authenticating correctly. If something is not ready, we wait. That decision is mine to make and mine to explain.
Saying “it is completely safe”. The enforcement step carries risk if done carelessly, and the technical person in the room knows it. Claiming otherwise costs you their trust for the whole engagement.
This is the objection where a precise answer is commercially better. Answering it precisely marks you as someone who has done this before.
The record takes 10 minutes. What takes ongoing work is that your sending estate keeps changing — marketing signs up for a new tool, a vendor rotates their keys, someone adds a subdomain. Any of those can silently break authentication, and you would find out from a customer, not from us. The monthly fee is monitoring and reacting to drift, plus the reporting you will want when an insurer or auditor asks.
Justifying it by feature count. They are not buying features, they are buying the absence of a problem they cannot see. Talk about drift.
If they still push, offer the split fee: a fixed project fee for getting to enforcement, then a smaller monthly for monitoring. Some clients prefer that shape.
Technically yes — the record is public and there are free tools. What you would be taking on is reading XML reports every week, chasing your own vendors for DKIM setup, and remembering to check after every change to your marketing stack. That is a few hours a month of someone’s attention indefinitely, on a task that is invisible when it works. Most clients decide their time is worth more than the fee.
Pretending it is technically hard. A capable IT person will call that out, and you lose credibility on everything else you said.
Respect the question. Clients who ask it are often testing whether you will be straight with them, and a direct answer frequently closes the deal.
We will price our side. You set yours.
Our wholesale rate is published and fixed, so the only variable is what your market supports. Move both sliders and the panel does the arithmetic — including telling you which of the two partner plans is cheaper at your domain count.
We deliberately do not suggest a number here. Retail depends on your market, whether you bundle it into an existing security line, and how much of the labor you are absorbing — all things you know and we do not.
Gross margin on the platform only. It does not price your technician’s time, and on a messy client that labor dwarfs the license cost. Treat the discovery and alignment work as project revenue instead of absorbing it into this figure. Every domain on the slider is billed from the day it is enrolled, whether or not it is sending mail, so parked and silent domains still cost you at the same rate.
The marginal cost of one more client once you are already past a plan’s included allotment — domains × the overage rate. Below the allotment the marginal cost is $0 until you cross it.
Four questions we cannot answer well.
Every one of these is also on our public MSP page, so a prospect who does their homework will find them anyway. There is no version of this where hiding them helps you.
Three assets with your name on them.
The portal, the login email and the prospect-scan PDF carry your brand once your vanity domain and sending domain are verified. Alert and digest emails still carry a DDMARC footer today.
White-label client one-pager
A single page explaining the service in plain language, with your logo and no mention of us. Print it or attach it — it lands better after the first meeting than during one.
Open the one-pager →White-label prospect scan
Grade up to 50 domains in one pass, 200 a day, and export a branded PDF with your logo. It is a sales tool, not a provisioning one: it does not create customers, it gives you a reason to call them.
How the scanner works →Client-facing dashboard
Set up by CNAME on your own domain, with your branding. Each client sits in their own organization under your tenant, signs in by typing their domain, and never sees another client.
White-label setup guide →Six things to set before a client notices.
Every one of these is a support ticket if it waits until a client hits it.
What partners ask us.
Partner Starter is $119/month base and includes your first 30 domains. Past 30, each additional domain is $3.99/month, metered monthly — you only pay for what is under management that month. It is fully self-serve: subscribe online with a card, no sales call.
You do not mix them — you upgrade. Partner Starter is the cheaper plan up to 75 domains; from 76 domains up, Partner's $299/month base with 100 domains included works out cheaper than Starter's per-domain metering. The calculator on this page always prices the cheaper of the two for your domain count.
Not on partner plans; the card is charged at checkout. Learn the dashboard on the free plan with your own domain, then subscribe. Cancel any month from the Stripe portal.
Mostly no. Your clients sign in to a branded portal on your own domain, and once you verify your vanity domain and sending domain, the login email and the prospect-scan PDF carry your logo too. There is no other client-downloaded document to brand — the customer portal itself has no export.
Take it into the meeting.
Run the free checker on the prospect’s domain before you go in. Their own failing record is a better argument than anything on this page.