Endpoint agents and backups usually top the onboarding list. The outside-facing parts (who controls the domain, who can send email as the client, which certificates exist) are often left until something breaks. They're quick to check, and the first week is when the client can still tell you where the passwords are.
Work through it per domain. Most clients have more than one: old brand names, country domains, the one the previous IT company registered.
1. Find every domain
- Ask for a list, then check it: domains in the email tenant (Microsoft 365 or Google Workspace accepted domains), the website, invoices and email signatures.
- Note which are in use for email, which for the web, and which are parked.
2. Registrar and ownership
- Which registrar, and whose account? It should be the client's, in a shared company mailbox, not a former employee's or the previous MSP's.
- Get access, or a named contact who has it. Record it in your documentation.
- Two-factor authentication on the registrar account.
- Expiry date and auto-renew on, with a valid card.
- Transfer lock on (
clientTransferProhibited). See domain status codes. - Registrant contact details correct, and private in WHOIS where possible.
- For the domain email runs on, consider a registry lock.
3. DNS
- Where is DNS hosted (registrar, Cloudflare, the web host)? Get access.
- Export the zone and keep a copy, so you can tell later what changed.
- Look for records pointing at services the client no longer uses: old CNAMEs to cloud apps are how subdomain takeovers happen.
- If DNSSEC is on, note who manages the keys before anyone changes nameservers.
4. Email authentication
- SPF: one record, every sending service listed, within the 10-lookup limit.
- DKIM: on in the mail tenant and in every service that sends as the client. See set up DKIM.
- DMARC: published with a reporting address you'll read. Plan the move to enforcement: DMARC from none to reject.
- Parked domains:
v=spf1 -allandp=reject, so they can't be used to spoof the client.
5. Certificates
- List every hostname with a certificate from CT logs (certificate finder), not only the ones the client mentions.
- For each: where it's installed, when it expires, and whether renewal is automatic, automatic but installed by hand, or fully manual.
- Check what each host actually serves; a renewed certificate that was never installed looks fine until it expires.
- Add a CAA record listing the CAs in use.
See SSL certificate monitoring for MSPs for keeping this up to date.
6. Lookalikes and impersonation
- Check for registered lookalikes of each domain, especially ones with mail servers (lookalike domain checker).
- Ask whether the client has had fake invoices or "change of bank details" emails. If so, see someone is pretending to be my company.
- Agree a rule with the client's finance team: bank details are never changed on the strength of an email alone.
7. Set up monitoring and reporting
- Monitoring for domain expiry, transfer lock, registrar and nameserver changes, certificate expiry, SPF and DMARC, and new lookalikes.
- Alerts to your team's channel, grouped by client.
- A baseline report to show the client what you found and fixed in the first month.
Do the first pass in a minute
The MSP domain security report covers the public parts of sections 2, 4, 5 and 6 (expiry, transfer lock, SPF, DMARC, certificates and lookalikes) from public data, and gives you a shareable report for the kickoff meeting. The MSP plan keeps the monitoring in section 7 running for up to 25 clients, with alerts and a monthly white-label report.