How to sell domain and email health to clients

Sell the outcome, not the acronym

Most small business owners have never heard of SPF, DKIM or DMARC, and have no reason to care. What they do care about is easy to name:

• Their quotes and invoices landing in the customer's inbox, not the spam folder.
• Nobody being able to email their customers pretending to be them.
• Their website and email not disappearing because a domain renewal failed.
• Not having to think about any of it.

Each of those maps to something technical: authentication records, a DMARC policy at reject, expiry and certificate monitoring, and someone watching it all. Talk about the first column, deliver the second. The technical detail belongs in your notes and in the appendix of the proposal, not the pitch.

If the client wants evidence that the risk is real, use a source that will stand up. The UK government's Cyber Security Breaches Survey 2025/26 found that 43% of businesses reported a breach or attack in the previous 12 months, that phishing was "the most prevalent type of breach or attack by far" (38% of businesses), and that 12% reported impersonation attacks. Quote it accurately and don't stretch it: those figures are about all breaches, not just email spoofing.

Three ways to open the conversation

A statistic about other companies is easy to ignore. A finding about the client's own domain isn't. Each of these openers starts with a free domain health check of their domain, run before the meeting.

1. The finding. "I ran a quick check on your domain. Anyone can currently send email that looks like it comes from you, because there's no DMARC policy. It's a short job to fix. Want me to show you?" The DMARC checker gives you the exact record to point at.

2. The date. "Your domain is due for renewal in March. Do you know whose card it's on?" Most owners don't, and it leads naturally into who looks after the domain, the certificate and the email records.

3. The grade. Show the overall grade and say what would move it up. "You're a D. Three fixes get you to a B, and here they are." A letter grade is something a business owner understands at a glance, and the sample report card shows what they'd receive each month.

Whichever you use, lead with one finding, not twenty. A long list of red marks reads as either alarmist or overwhelming, and the client will put it off.

What goes in the proposal

Keep it to a page or two. A structure that works:

1. What we found. The grade today and the top three problems, each in one sentence of business consequence.
2. What we'll fix. The one-off work: authentication records for each service that sends as them, DMARC moved to reject in stages, the domain registration moved into their name with renewal checked, and their unused domains locked down.
3. What we'll watch. Daily checks of the domain, certificates and email records, with alerts to you, not to them.
4. What they'll see. A monthly report card with their grade, what changed and what's next.
5. What it costs, as a set-up fee and a monthly line.
6. Who does what. Who holds the DNS login, who approves changes, and what happens when the client signs up for a new email tool.

The "we'll fix" section is where the hours are. Moving a domain with several senders to reject takes weeks, not minutes; our staged plan from p=none to p=reject is a fair outline to scope it from.

Pricing the service line

Two numbers: a set-up fee that pays for the fixing, and a monthly fee that pays for the watching, the occasional fix and the report. Set them from your own costs:

The tooling is the smallest part; your time is the biggest. Price so the monthly fee still works in a month when something breaks. Our guide on adding domain and email health to a care plan shows example tiers, clearly labelled as examples, and pricing sets out what each of our plans covers.

Put it on the invoice as its own line. A named service with a monthly report behind it is far harder to cut than an unexplained increase to a retainer.

Handling the usual objections

"We've never had a problem." Spoofing happens to the people who receive the forged email: the client's customers and suppliers. The client often never hears about it. Show them the check, and later the DMARC reports, which list every server sending as their domain.

"We're too small to be targeted." Invoice fraud doesn't need a big target, just a believable sender. A small firm with regular suppliers is exactly that.

"Our IT company does email." Then the report is something to share with them. You're not replacing anyone; you're checking the work daily.

"Can't we just fix it once?" Yes, and you should. But records drift: a new newsletter tool, a DNS move, a card that expires. The monthly fee pays for noticing.

Notes for MSPs

If you already manage the client's Microsoft 365 or Google Workspace, this fits beside it. You likely set up the mailboxes, so you're best placed to finish the job: DKIM signing turned on, every third-party sender aligned, DMARC at reject, and the large providers' sender requirements met. Many MSPs bundle it into a security tier rather than selling it alone. Our page for small MSPs covers alerts by webhook and how it sits with the tools you already run.

Keeping them: the monthly proof

The hardest thing to sell is something that works quietly. When nothing goes wrong, the client forgets why they're paying. The answer is a short, regular, plain-English report: the grade, the trend, what changed this month, and the next three fixes. A grade that moved from D to B is proof of work a client can see. A renewal date on the report shows you're watching before anything breaks.

That's what the Domain Health Hub report card is for: one per client, with your logo, sent on a schedule. If you're comparing tools for this, our comparison pages set out how we differ from the main DMARC services, and our page for web agencies shows the whole workflow.

Doing this for clients? Domain Health Hub checks every client domain each day and puts the results in a monthly report card with your logo. Start a free trial; no card needed.