Blog
Email security, straight talk.
Commentary for MSPs, from the team behind ActiScan.
DMARC
The SPF Blind Spot That Turns Client-Authorized Senders Into Client Complaints
A client's marketing platform or billing vendor was approved months ago, quietly sends mail under the client's domain, and was never added to SPF. When DMARC enforcement catches up with it, the client calls the MSP, not the vendor.
Rodney Hall, COO
November 12, 2026
DMARC
How MSPs Miss Revenue When DMARC Policy Enforcement Breaks Third-Party Marketing Automation That Clients Don't Know They're Running
A tightened DMARC policy doesn't just stop phishing. It can silently kill a client's lead-gen email the moment marketing signed up for a tool IT never knew existed. Here's how MSPs find these gaps before the support ticket does.
Rodney Hall, COO
November 11, 2026
DMARC
The Silent DKIM Failure: How MSPs Lose Revenue When Key Rotation Breaks Internal Signing
Internal apps and relays sign mail under a client's domain long after anyone remembers they exist. When a key rotates and nobody checks the signature chain, deliverability quietly erodes until the client notices first.
Rodney Hall, COO
November 10, 2026
DMARC
How MSPs Miss Revenue When DMARC Rejects Clients' Own Internal Email
A client's DMARC policy can quietly swallow its own invoices, password resets, and internal memos long before anyone traces the cause back to a bloated SPF record. Rodney Hall breaks down the exact mechanics of the failure and where MSPs leave billable work on the table.
Rodney Hall, COO
November 9, 2026
DMARC
The Revenue MSPs Leave on the Table When a Protected Domain Gets Weaponized Elsewhere
A client's domain can pass every DMARC check and still end up as the launchpad for an attack on someone else's organization. For MSPs, that gap between "authenticated" and "under control" is where billable work quietly disappears.
Rodney Hall, COO
November 6, 2026
DMARC
The Hidden Revenue in DMARC Reports: Unauthorized Senders Your Clients Never Knew They Had
Most MSPs scan DMARC aggregate reports for spoofing and stop there. The bigger opportunity, and the bigger risk if ignored, is the legitimate mail volume failing authentication because nobody ever wrote it into the SPF record.
Rodney Hall, COO
November 5, 2026
DMARC
When DMARC Passes But the Client Still Gets Burned: The Revenue MSPs Lose to Authenticated Phishing
A green DMARC checkmark tells a mailbox provider the sender was authorized. It says nothing about whether that sender's account, mailing platform, or outbound relay was just hijacked. For MSPs, that gap is where client trust, renewal revenue, and liability exposure quietly leak out.
Rodney Hall, COO
November 4, 2026
DMARC
The Third-Party Senders Nobody Told You About: Why MSPs Discover SPF Gaps After the Breach, Not Before
Every client domain accumulates marketing tools, invoicing platforms, and helpdesk software that quietly send mail on its behalf. Most never make it into an SPF record until a spoofed invoice or a failed audit forces the question. That gap is both a security liability and a service line MSPs are leaving on the table.
Rodney Hall, COO
October 29, 2026
DMARC
The Allowlist Time Bomb: Why MSPs Need to Audit Every Client's Gateway Exceptions Before DMARC Enforcement
A single forgotten "safe sender" entry can quietly erase months of DMARC hardening. Here's why gateway allowlists deserve the same audit discipline MSPs apply to DNS records, and what happens when nobody checks.
Rodney Hall, COO
October 28, 2026
DMARC
The p=reject Finish Line Is Costing MSPs a Recurring Revenue Line
A client reaching p=reject looks like a closed ticket, but the DNS record doesn't stop needing attention the day the project ends. This piece lays out the operational and financial case for treating DMARC monitoring as its own billable line, not a bonus thrown in with the setup fee.
Ric Hall, CRO
October 22, 2026
DMARC
The Phishing Template Loophole: Why DMARC-Enforcing Clients Still Get Breached
A client at p=reject calls in a panic because a lookalike invoice email just fooled the controller. This is the conversation MSPs need to have before that call comes in, and the service line it should turn into.
Ric Hall, CRO
October 21, 2026
DMARC
The Silent Authentication Gap: When Clients' Own Systems Break SPF and DKIM
A client's invoicing platform migrates to new sending infrastructure, nobody tells the MSP, and the SPF record quietly stops matching reality. Here is why this failure mode hides from routine monitoring and what operational habits catch it before a customer does.
Rodney Hall, COO
October 20, 2026
Domain Reputation
The Domain Reputation Blind Spot: Why DMARC-Compliant Clients Still Land on Blacklists
A client's authentication records can be flawless and their domain can still end up on a blocklist. The reason sits outside the DMARC record entirely, in the lookalike infrastructure attackers build around a trusted brand.
Ric Hall, CRO
October 20, 2026
MSP Operations
Why MSPs Who Win DMARC Enforcement Still Lose Clients to Inbound Email Fraud
A client can reach p=reject on every domain the MSP manages and still wire $80,000 to a fraudster next Tuesday. Here is the coverage gap that keeps showing up in post-incident reviews, and the inbound layer that closes it.
Ric Hall, CRO
October 19, 2026
Email Security Sales
DMARC Enforcement Won't Save the Renewal When a Client's Vendor Gets Breached
A client's domain can be locked down tight and still take a loss the week a payroll processor or SaaS vendor gets breached. Here is why that gap shows up in renewal conversations, and what MSPs need to sell around it.
Ric Hall, CRO
October 16, 2026
DMARC
The Inbound Authentication Paradox: Why Clients Who Enforce DMARC Still Accept Mail From Domains That Don't
A client proudly publishes p=reject and assumes the inbox is safe. Meanwhile their mail server is still waving through spoofed messages from domains with no DMARC record at all. Here is the asymmetry MSPs need to explain before a client finds out the hard way.
Randy Hall, CEO
October 13, 2026
DMARC
The Forgotten Quarantine Pile: Why DMARC-Enforcing Clients Miss Their Own Legitimate Senders
Moving a client's domain to p=quarantine is treated as a finish line, but the real authentication work starts the day the first batch of legitimate mail lands in spam. Here's what gets lost when nobody checks the pile.
Rodney Hall, COO
October 12, 2026
DMARC
Authentication Stack Debt: Why Old DMARC Wins Are Quietly Failing New Vendors
Clients who locked down DMARC enforcement years ago assume the job is finished. In reality, every SaaS tool added since then has been quietly accumulating risk against a DNS record nobody has touched.
Randy Hall, CEO
October 12, 2026
MSP Operations
Why DMARC Monitoring Deserves Its Own Line on the Invoice
Folding DMARC monitoring into a flat managed-services fee feels generous to clients, but it quietly erases the labor behind it. Ric Hall breaks down why treating DMARC as its own billable service protects both the MSP's margin and the client's security posture.
Ric Hall, CRO
October 9, 2026
DMARC
The DNS Query Explosion: The Hidden Infrastructure Cost of DMARC Monitoring at Scale
Every domain an MSP monitors for DMARC adds a steady drumbeat of SPF checks, aggregate report lookups, and record polling. Multiply that by a few hundred clients and the DNS traffic itself becomes an operational line item worth planning for.
Randy Hall, CEO
October 9, 2026
DMARC
The Post-Enforcement Onboarding Gap: Why DMARC Wins Don't Survive M&A
Getting a client to p=reject is a milestone, not a finish line. When that client buys another company, the acquired domain's authentication gaps can undo months of work overnight, and most MSP contracts never account for it.
Ric Hall, CRO
October 8, 2026
Email Security Strategy
The Quiet Compliance Exposure: How Email Authentication Gaps Create Uninsured Liability for Your Clients
A DMARC record that says p=none can look identical to compliance on paper and completely different in an insurer's forensic review. Here's why that gap has become an MSP liability problem, not just a technical one.
Randy Hall, CEO
October 8, 2026
DMARC
The Vendor Onboarding Bottleneck: Why DMARC-Enforcing Clients Still Can't Safely Add New Marketing Platforms
A marketing team signs a new ESP contract, and three days later the client's invoices start bouncing. This is the quiet failure mode hiding inside every DMARC rollout, and it is reshaping what MSPs are expected to manage.
Ric Hall, CRO
October 7, 2026
DMARC
Why DMARC Enforcement Quietly Drifts Back to p=none
A client reaches p=reject, the project gets marked closed, and eighteen months later the record is back to monitoring mode with nobody the wiser. Here is the mechanism behind that regression and what MSPs need in place to catch it before an attacker does.
Rodney Hall, COO
October 7, 2026
MSP Operations
The Hidden Margin Trap in DMARC Enforcement Deals
Flat monthly DMARC fees look clean on a quote. Then a client adds a marketing platform, a new SPF include breaks, and enforcement stalls for months while the meter never moves. Here is where the economics actually break down, and how to price around it.
Randy Hall, CEO
October 7, 2026
Email Security
The Credential Stuffing Exploit: Why DMARC-Compliant Domains Still Become Phishing Vectors
A fully enforced DMARC policy stops forged mail from a client's own domain, but it does nothing to stop a criminal who logs into a real customer account with a stolen password. Here's the gap MSPs need to close and the services that close it.
Ric Hall, CRO
October 6, 2026
DMARC
The SPF Redirect Trap: Why Flattening Fixes PermError Today and Breaks Mail Flow Later
A flattened SPF record looks clean in a scan report, but that cleanliness hides the fact that nobody is watching for the IP changes it was built on. Here's why the fix MSPs reach for first often becomes the outage nobody saw coming.
Rodney Hall, COO
October 6, 2026
Email Authentication
The SPF 10-Lookup Ceiling Is Quietly Forcing MSPs to Rearchitect Client Domains
A decades-old cap on SPF's DNS lookups is colliding with SaaS sprawl and tighter inbox-provider enforcement, and MSPs are finding out the hard way when client mail silently stops delivering. Here is what's driving the breakage and how service providers are getting ahead of it.
Randy Hall, CEO
October 6, 2026
DMARC
The DMARC Blind Spot: Why Blocking Outbound Spoofing Isn't the Whole Job
Getting a client to p=reject feels like a finish line, but it only closes the door on one direction of attack. Here's the inbound exposure that remains, and the service opportunity hiding inside it.
Ric Hall, CRO
October 5, 2026
MSP Operations
Stop Selling DMARC as a Project. Sell It as a Line Item.
Too many MSPs still quote DMARC as a fixed-fee setup and move on. That pricing model ignores what the protocol actually requires and leaves recurring revenue on the table with every client domain.
Randy Hall, CEO
October 5, 2026
Deliverability
The Inbox Placement Tax: When DMARC-Compliant Mail Still Lands in Spam
Clients who finished their DMARC rollout last year assumed the deliverability project was closed. Gmail, Yahoo, and now Microsoft have quietly moved the finish line, and MSPs who aren't watching spam complaint rates and unsubscribe headers are about to field some uncomfortable calls.
Ric Hall, CRO
October 2, 2026
MSP Operations
The Free Domain Scan Is a Qualification Tool, Not a Giveaway
Most MSPs bolt a free DMARC checker onto their homepage and hope for leads. The tool works far better when it is treated as the first diagnostic step in a sales process, not a piece of marketing decoration.
Randy Hall, CEO
October 2, 2026
DMARC
The Ghost Sender Problem: Why Outbound DMARC Compliance Doesn't Mean Internal Visibility
An MSP can show a client a clean DMARC dashboard and still have no idea that a line-of-business app, an old print server, or a departed vendor's SMTP relay is sending mail under that domain. This piece walks through why aggregate reports alone don't close that gap, and what MSPs need to track instead.
Rodney Hall, COO
October 1, 2026
MSP Operations
How to Price DMARC Monitoring So It Actually Grows With Your Client Base
Flat per-client DMARC fees look tidy on a rate card until the tenth domain onboards and margin quietly disappears. Here is how pricing tiers, setup fees, and complexity-based billing keep DMARC monitoring profitable as an MSP book expands.
Randy Hall, CEO
October 1, 2026
DMARC
The Hidden Cost of DMARC Enforcement: Finding Every Sender Before You Flip the Switch
Pushing a client domain from monitoring to enforcement always surfaces senders nobody remembered to authenticate. This piece walks through the discovery process that keeps quarantine and reject from turning into a support queue.
Rodney Hall, COO
September 30, 2026
DMARC
The Vendor List DMARC Enforcement Forces You to Confront
Moving a client to DMARC enforcement doesn't just fix deliverability. It surfaces every unauthenticated vendor sending mail from that domain, and turns a technical rollout into a compliance record MSPs need to be ready to produce.
Randy Hall, CEO
September 30, 2026
DMARC
The DMARC Handoff Problem: Why Inherited Policies Cost More Than New Ones
A client's old DMARC record rarely means their old vendor did the hard work. Rodney Hall breaks down why untangling someone else's half-finished SPF and DKIM setup is where MSP margins actually get squeezed.
Rodney Hall, COO
September 29, 2026
MSP Operations
The Silent Revenue Leak: Why MSPs Are Leaving Money on the Table by Not Monitoring Email Authentication Decay Post-Enforcement
A DMARC rollout that hits enforcement is treated like a finished project in most MSP contracts, but SPF, DKIM, and DMARC records keep aging after the deal closes. This piece looks at where that aging quietly costs both the client and the provider.
Randy Hall, CEO
September 29, 2026
Industry News
What DigiCert's Acquisition of Valimail Tells Us About Where Email Security Is Headed
A certificate authority just bought one of the biggest names in DMARC. For MSPs managing dozens of client domains, that says more about the next few years of email security than any product roadmap slide could.
Randy Hall, CEO
September 28, 2026
DMARC
Finding Every Legitimate Sender Before DMARC Enforcement Finds Them First
Every MSP that has pushed a client toward p=reject has learned the same lesson the hard way: the invoicing tool nobody remembered, the CRM that sends on the client's behalf, the marketing platform that was set up two account managers ago. This is the operational discipline for finding them first.
Rodney Hall, COO
September 28, 2026
Email Security Strategy
The Real Cost of Skipping Email Security: What the FBI's Latest Numbers Mean for MSPs
A fresh look at the FBI's newest cybercrime numbers shows email fraud is not slowing down, and MSPs who treat authentication as optional are the ones absorbing the fallout. Here is what the data actually says about the exposure sitting in client domains.
Randy Hall, CEO
September 25, 2026
DMARC
The Operational Reality of Running DMARC Across Every Client Domain You Own
Publishing a DMARC record is a five-minute task. Keeping hundreds of client domains correctly authenticated, aligned, and moving toward enforcement is a permanent operational commitment that most MSPs underestimate until it breaks something.
Rodney Hall, COO
September 25, 2026
Industry News
AI vs. AI: What the 2026 Email Threat Data Actually Means for Security Strategy
The 2026 threat reports are in, and the headline is not that AI writes better phishing emails. It is that the fundamentals MSPs have underfunded for years are now the difference between a contained incident and a headline.
Randy Hall, CEO
September 24, 2026
DMARC
Automating DNS Fixes Without Breaking Mail Flow: A Field Guide
Auto-remediation scripts can push a bad SPF or DMARC change to every client domain in seconds. Here is how disciplined MSPs stage DNS automation so the fix does not become the outage.
Rodney Hall, COO
September 24, 2026
DMARC
Rolling Out DMARC Enforcement Without Breaking Client Mail Flow
A missed invoicing platform or a forgotten marketing tool can turn a routine policy change into a Monday morning of angry client calls. Here is how disciplined MSPs move clients to full DMARC enforcement without a single legitimate message getting dropped.
Rodney Hall, COO
September 23, 2026
DMARC
BIMI in 2026: What It Actually Takes to Get a Client's Logo Into the Inbox
Client logos in Gmail and Apple Mail don't come from a DNS record alone. This is the operational checklist MSPs need before promising BIMI results, from DMARC enforcement to certificate math.
Rodney Hall, COO
September 23, 2026
Email Security
Email Security Just Became a Line Item, Not an Upsell
Insurance applications, mailbox provider rules, and client expectations have quietly moved email authentication from optional add-on to required baseline. Here is what changed and how MSPs should adjust pricing before a competitor does it first.
Randy Hall, CEO
September 21, 2026
DMARC
DMARC Just Became Internet Law — And That Changes the Math for Every MSP
Four separate mandates converged in the same eighteen months, turning a once-optional DNS record into a baseline requirement for anyone who sends business email. Here is what changed, why it matters for client contracts, and where MSPs stand to gain or lose the most.
Randy Hall, CEO
September 19, 2026
DMARC
The SPF and DKIM Mistakes That Actually Break Client Mail Flow
A duplicate TXT record or a mistimed key rotation can silently take down every outbound message for a client, long before anyone notices a DMARC report. Here's where SPF and DKIM actually fail in production, and how MSPs catch it before the help desk does.
Rodney Hall, COO
September 18, 2026
Industry News
From Optional to Mandatory: What Google and Yahoo's Bulk-Sender Rules Really Signal
Two years after Google and Yahoo announced bulk-sender authentication rules, enforcement has finally arrived, and Microsoft followed with its own version. This is a look at what the shift from soft warnings to hard rejections means for how MSPs price and deliver email security.
Randy Hall, CEO
September 17, 2026
MSP Operations
Why Email Authentication Is Becoming a Standard Line Item in MSP Contracts
Mailbox providers, insurers, and regulators have quietly turned SPF, DKIM, and DMARC from optional add-ons into baseline expectations. MSPs that still bundle authentication into "email support" instead of pricing it separately are leaving money and leverage on the table.
Randy Hall, CEO
September 17, 2026
Industry News
What Two September Acquisitions Tell Us About Where Email Security Is Headed
Two deals closed within two weeks of each other point at the same conclusion from opposite directions: authentication and AI detection are converging into a single problem that platforms, not point tools, are being built to solve.
Randy Hall, CEO
September 17, 2026
Email Security & Compliance
Email Authentication Is Now an Insurance Line Item — MSPs Should Treat It Like One
Underwriters have stopped taking an applicant's word for it on email security. They're running their own DNS lookups, and a domain sitting at p=none is starting to look like an unfixed vulnerability on a scan report.
Randy Hall, CEO
September 17, 2026
Industry News
AI Has Changed the Math on Email Threats — and on Defending Against Them
Generative AI has quietly stripped away the tells that used to make phishing easy to spot, and the click-through numbers prove it. Here is what the data says about the shift, and the specific controls that still hold up against it.
Randy Hall, CEO
September 17, 2026
DMARC
DMARCbis, p=reject, and the Next Phase of Email Authentication Enforcement
DMARC just moved from a decade-old informational spec to a real IETF standard, and mailbox providers are no longer treating p=none as good enough. Here is what changed, who is forcing the issue, and how MSPs should sequence client domains toward enforcement.
Randy Hall, CEO
September 17, 2026
DMARC
Gmail's Enforcement Wave Is Here — And the Federal Government Already Showed Us What Comes Next
Google stopped warning and started rejecting mail in November 2025. Federal agencies lived through this exact playbook under a 2017 directive, and their eight-year record offers a blunt preview of what happens when a deadline passes and the DNS records still aren't right.
Randy Hall, CEO
September 17, 2026
Email Security
Why Email Security Just Became a Standard Line Item, Not an Upsell
Mailbox providers, regulators, and cyber insurers have quietly rewritten the rules of the inbox. For MSPs still pitching DMARC as a premium add-on, the market has already moved the goalposts.
Randy Hall, CEO
September 17, 2026
DMARC
Rolling Out DMARC Enforcement Without Breaking Client Mail Flow
Pushing a client straight to p=reject is how helpdesk tickets happen. Here's the staged, evidence-driven path MSPs use to reach full DMARC enforcement without dropping invoices, password resets, or a CEO's newsletter mid-migration.
Rodney Hall, COO
September 17, 2026
Industry News
Four Deals, One Signal: Email Authentication Is Consolidating Into the Platform Players
DigiCert, Proofpoint, KnowBe4, and Cloudflare have all folded standalone email authentication companies into bigger platforms in the last few years. For MSPs, that shift changes how DMARC gets bought, priced, and supported.
Randy Hall, CEO
September 17, 2026
MSP Operations
The Business Case for Adding Email Security Monitoring to Your MSP Stack
Regulators, mailbox providers, and criminals have all moved on email authentication faster than most client contracts have. This is the operational and financial argument for MSPs to close that gap now, not at the next renewal cycle.
Randy Hall, CEO
September 17, 2026
Industry News
AI Is Now Fighting AI in the Inbox — Here's What That Means for MSPs
Phishing generation and phishing detection are both running on large language models now. For MSPs, the practical question isn't who wins the arms race, it's which layers of defense still hold when the words in an email stop giving attackers away.
Randy Hall, CEO
September 17, 2026
Industry News
From Mailbox Rules to Law: Where Email Authentication Mandates Are Headed Next
DMARC started life as a voluntary anti-spoofing header. It is now showing up in payment card audits, federal procurement rules, and IETF standards documents. Here is how MSPs should read that shift.
Randy Hall, CEO
September 17, 2026
DMARC
DMARC Just Became a Standard — What That Comes to Mean Beyond Google and Yahoo
For over a decade DMARC ran the internet's email trust layer as a widely-adopted convention with no formal standing. That changed this year, and the shift reaches far past the mailbox providers who made it famous.
Randy Hall, CEO
September 17, 2026
MSP Operations
Why Email Authentication Is Turning Into Table Stakes in MSP Contracts
Mailbox providers, card networks, and insurance underwriters have quietly converged on the same three protocols. For MSPs, that convergence is turning SPF, DKIM, and DMARC from a nice-to-have upsell into a baseline clients will start asking for by name.
Randy Hall, CEO
September 17, 2026
Industry News
The Great Email-Security Roll-Up: What Proofpoint's $1.8B Hornetsecurity Deal Signals for MSPs
A $1.8 billion acquisition rarely changes how an MSP runs its Tuesday, but this one might. Here's what the Proofpoint-Hornetsecurity deal actually rewires for the technicians managing client mailboxes.
Randy Hall, CEO
September 17, 2026
MSP Operations
The Business Case for Adding Email Security Monitoring to Your MSP Stack
Clients keep asking why their inbox still lets phishing through despite antivirus and firewalls. The answer, and the revenue opportunity it creates for MSPs, comes down to a layer most stacks still treat as an afterthought.
Randy Hall, CEO
September 17, 2026
Email Security Strategy
AI Is Rewriting Both Sides of the Email Threat Equation
Generative AI has quietly become the biggest force multiplier in email fraud since the invention of the macro virus. This piece looks at what the newest attacker data actually shows, and why domain authentication remains the one lever that still works regardless of who is writing the message.
Randy Hall, CEO
September 17, 2026
DMARC
From Guidelines to Standards Track: Where Email Authentication Pressure Goes Next
DMARC just left its eleven-year run as an informal community convention and entered the IETF Standards Track. For MSPs, that shift changes the conversation with clients from "best practice" to "documented protocol requirement."
Randy Hall, CEO
September 17, 2026
MSP Operations
The Cross-Sell Sitting in Your Existing Client List
Most MSPs are hunting for new logos while a fully-funded, low-friction email security upsell sits untouched inside the accounts they already bill every month. Here is how to find it and price it without a single new sales call.
Ric Hall, CRO
September 17, 2026
MSP Operations
The First 24 Hours: Running Incident Response When a Client Domain Gets Spoofed
A client calls in a panic because their domain is showing up in phishing emails nobody in the office sent. Here is the hour-by-hour playbook MSPs need before touching a single DNS record, and why the instinct to jump straight to p=reject can make things worse.
Rodney Hall, COO
September 17, 2026
MSP Operations
The Proof-of-Value Gap Is Widening -- and Recurring Security Reports Close It
Clients only see the invoice, never the attack that never happened. Ric Hall breaks down why domain-security reporting cadence, not scan quality alone, is what actually saves renewals.
Ric Hall, CRO
September 16, 2026
DMARC
Automating DNS Record Fixes Without Breaking Client Mail Flow
Auto-remediation tools promise to fix broken SPF, DKIM, and DMARC records with a single click, but the wrong push at the wrong moment can knock a client's mail server offline. Rodney Hall walks through the guardrails MSPs need before letting any tool write to a client's DNS zone unsupervised.
Rodney Hall, COO
September 16, 2026
MSP Operations
Positioning Against Free DMARC Tools Without Sounding Defensive
Prospects who've already run a free DMARC generator aren't wrong to ask why they'd pay for more. Ric Hall breaks down the honest, non-defensive way to show them what a record generator can't do: read the reports, pace the enforcement, and manage it across every client domain.
Ric Hall, CRO
September 15, 2026
DMARC
BIMI and Brand Trust: What It Actually Takes to Roll Out
A verified logo in the inbox looks simple from the outside. Underneath it sits a DMARC enforcement policy, a certificate decision, and a DNS record that fails silently more often than anyone admits.
Rodney Hall, COO
September 15, 2026
MSP Operations
How to Actually Price DMARC Monitoring So MSPs Don't Race to the Bottom
Flat five-dollar DMARC add-ons look good on a quote sheet and terrible on a margin report. Here is how the smartest MSPs are structuring DMARC monitoring as a real, defensible service line instead of a loss-leading checkbox.
Ric Hall, CRO
September 14, 2026
MSP Operations
The Hidden Operational Tax of Managing DMARC Across Dozens of Client Domains
Every client domain an MSP onboards adds another DNS record to babysit, another report to parse, another SPF include that might tip past ten lookups. Rodney Hall breaks down where that time actually goes and what changes when the work stops being manual.
Rodney Hall, COO
September 14, 2026
MSP Operations
The Free Scan Play: Turning a Domain Check Into a Sales-Qualified Lead
A domain scan takes ninety seconds to run and can take months to turn into a signed contract if the follow-up process isn't built first. Here's how MSPs are using free authentication checks as a repeatable, defensible entry point into email-security deals.
Ric Hall, CRO
September 11, 2026
DMARC
The Monitor-to-Reject Playbook: Rolling Out DMARC Enforcement Without Breaking Mail Flow
Reject policies stop spoofing cold, but flipping the switch too soon is how MSPs end up with a support queue full of bounced invoices. Here's the report-driven sequence that gets clients to enforcement without collateral damage, including what the new DMARCbis tags change about the ramp.
Rodney Hall, COO
September 11, 2026
MSP Operations
Stop Quoting DMARC as a Project. Sell It as a Line Item.
Flat-fee DMARC projects end the moment the invoice clears, right when the real work of monitoring and enforcement begins. Here's why MSPs that rebuild DMARC as recurring revenue keep both the client and the protection.
Ric Hall, CRO
September 10, 2026
DMARC
The SPF and DKIM Mistakes That Actually Break Client Mail Flow
Most authentication failures MSPs chase down trace back to a handful of repeatable errors in how SPF and DKIM records are built and maintained. Rodney Hall breaks down the specific misconfigurations that cause silent bounces and quarantined mail, and how to catch them before a client notices.
Rodney Hall, COO
September 10, 2026
MSP Operations
The Easiest Sale You're Not Making: Cross-Selling Email Security to Current Clients
Most MSPs are still treating email authentication as a project instead of a product line. Here's why the client list already sitting in the PSA is the fastest path to new recurring revenue.
Ric Hall, CRO
September 9, 2026
DMARC
When a Client's Domain Gets Spoofed: An MSP's First 48 Hours
A spoofed client domain is a race against the clock, not just a DNS ticket. Here is how experienced MSPs sequence evidence collection, SPF and DKIM cleanup, and DMARC enforcement in the two days that decide whether the client stays.
Rodney Hall, COO
September 9, 2026
MSP Operations
Retention Isn't Won at Renewal — It's Won in the Reports You Send All Year
The renewal conversation an MSP dreads is usually a symptom, not a cause. By the time a contract comes up for signature, the client has already decided how they feel based on everything, or nothing, they saw in between.
Ric Hall, CRO
September 8, 2026
MSP Operations
Automating DNS Fixes Without Taking Down a Client's Mail Flow
A single unchecked SPF include or a rushed DMARC policy bump can silently bounce a client's invoices for days. Rodney Hall walks through the operational guardrails that keep DNS automation from becoming the incident it was supposed to prevent.
Rodney Hall, COO
September 8, 2026
MSP Operations
"We Already Have a Free DMARC Tool" -- How to Actually Answer That Objection
A prospect saying they already have DMARC covered usually means they published a record once and forgot about it. Here is how MSPs can reframe that objection around enforcement, multi-domain visibility, and the compliance deadlines their clients are already exposed to.
Ric Hall, CRO
September 7, 2026
DMARC
BIMI Rollout: What It Actually Takes to Get a Client's Logo in the Inbox
A client's logo next to their emails in Gmail looks like a quick marketing win, but the path there runs through DMARC enforcement, certificate procurement, and a DNS record that fails silently more often than it succeeds. Here is what the rollout actually involves.
Rodney Hall, COO
September 7, 2026
MSP Operations
Stop Pricing DMARC Monitoring Like a Tool. Start Pricing It Like an Outcome.
Most MSPs still slot DMARC monitoring into the tool stack next to antivirus and patching, priced at a few dollars a seat. That habit caps revenue and undersells what the service actually stops. Here's how to reframe the conversation around the business result clients are really paying for.
Ric Hall, CRO
September 4, 2026
DMARC
The Hidden Ceiling: What Actually Breaks When You Manage Email Authentication Across Dozens of Client Domains
A single client domain with SPF, DKIM, and DMARC configured looks solved. Multiply that by forty clients, each adding vendors on its own schedule, and the same three protocols start failing in ways no single-domain checklist ever anticipated.
Rodney Hall, COO
September 4, 2026
MSP Operations
Turning a Free Domain Scan Into Your Best Sales-Qualification Tool
A free domain scan only pays off when it separates browsers from buyers. Here is how MSPs can turn a simple DNS lookup into a repeatable qualification step that fills the pipeline with prospects who already know they have a problem.
Ric Hall, CRO
September 3, 2026
MSP Operations
Recurring Revenue Is Already the MSSP Story of 2026 — Email Security Should Be Riding It
Channel data from ScalePad, Kaseya, and MSSP Alert all point the same direction this year: growth is concentrating in recurring security services. Here's why domain and email authentication is the easiest line item MSPs can turn into a standing monthly contract.
Ric Hall, CRO
September 2, 2026
DMARC
Why SPF and DKIM Break Mid-Year: The Client DNS Drift MSPs Miss
A client's email authentication passes cleanly at onboarding, then fails in August after nobody touched a thing. The culprit is rarely a hack. It is DNS drift, and most MSPs have no process for catching it between reviews.
Rodney Hall, COO
September 2, 2026
MSP Operations
The Cross-Sell Sitting in Your Existing Client Base: Email Authentication
Most MSPs already have the client relationships, the DNS access, and the billing infrastructure needed to sell DMARC monitoring. What's missing is the pitch. Here's how to build one from mailbox provider deadlines already sitting in your clients' inboxes.
Ric Hall, CRO
September 1, 2026
DMARC
What to Do in the First 24 Hours After a Client's Domain Gets Spoofed
A spoofed client domain does not wait for business hours, and neither should the response plan. Here is the exact sequence an MSP should run through in the first day, from DNS triage to registrar reporting to the DMARC policy change that actually stops the next wave.
Rodney Hall, COO
September 1, 2026
MSP Operations
Client Retention Runs Through the Report, Not Just the Fix
A perfectly configured DMARC policy that no one ever sees is a renewal risk waiting to happen. Ric Hall breaks down why the report, not the remediation, is what actually keeps email-security clients on the books.
Ric Hall, CRO
August 31, 2026
MSP Operations
Automating DNS Record Fixes Without Breaking Client Mail Flow
A single SPF include added at the wrong moment can silently drop legitimate mail for weeks. Here is how MSPs can automate DNS authentication fixes while keeping every client mailbox flowing.
Rodney Hall, COO
August 31, 2026
MSP Operations
Why "I Already Use a Free DMARC Tool" Is the Start of the Sales Conversation, Not the End of It
A prospect who mentions a free DMARC checker has already admitted the domain needs watching. The real question an MSP should ask next is who is actually moving that policy toward enforcement, and that question is where the deal gets won.
Ric Hall, CRO
August 28, 2026
DMARC
What a BIMI Rollout Actually Requires — And Where It Breaks
Brand logos in the inbox sound like a simple DNS record and a nice-to-have marketing win. In practice, BIMI sits on top of a DMARC enforcement policy, a certificate market that just lost one of its two issuers, and an SVG format most design tools can't produce correctly on the first try.
Rodney Hall, COO
August 28, 2026
MSP Operations
Four Ways MSPs Are Pricing DMARC Monitoring — And Why the Model Matters More Than the Rate
Every MSP quoting DMARC monitoring eventually asks the same question: charge per domain, per client, per user, or bundle it in? The dollar figure matters less than which billing structure survives a client's next acquisition, product launch, or subdomain sprawl.
Ric Hall, CRO
August 27, 2026
DMARC
The Gap Between "Has a DMARC Record" and "Actually Protected" Is Where MSPs Live
A TXT record with v=DMARC1 in it tells a client's compliance checklist that DMARC is "done." It tells an attacker almost nothing has changed. Here's why that gap is the actual job for MSPs managing email security at scale.
Rodney Hall, COO
August 27, 2026
MSP Operations
The Free Domain Scan: Turning a DMARC Gap Into a Sales Conversation
A missing DMARC record is one of the easiest security gaps to prove and one of the hardest for a prospect to argue with. Here is how top-performing MSPs use a free scan as the opening move in a paid email-security engagement.
Ric Hall, CRO
August 26, 2026
DMARC
The Safe Path From p=none to p=reject: A DMARC Enforcement Playbook
A domain sitting at p=none for months is still wide open to spoofing, yet rushing to p=reject without reading the reports first is how MSPs break client mail flow. Here is the staged, report-driven route between the two, updated for the newly published DMARC standard.
Rodney Hall, COO
August 26, 2026
MSP Operations
Stop Selling DMARC as a Project. Start Selling It as a Line Item.
Most MSPs still quote DMARC the way they quote a server migration: a fixed scope with an end date. That framing kills recurring revenue and leaves clients exposed the moment enforcement drifts. Here's why the smarter play is a monthly line on the invoice, not a closed ticket.
Ric Hall, CRO
August 25, 2026
DMARC
The SPF and DKIM Mistakes We Keep Finding in Client DNS Records
Most authentication failures MSPs troubleshoot were baked into DNS months earlier by a stale include, a duplicate TXT record, or a key nobody rotated. Here is what shows up over and over during client audits, and how to catch it before Gmail or Yahoo does.
Rodney Hall, COO
August 25, 2026