# MSP client onboarding checklist: domains, DNS, email and certificates

Endpoint agents and backups usually top the onboarding list. The
outside-facing parts (who controls the domain, who can send email as the
client, which certificates exist) are often left until something breaks.
They're quick to check, and the first week is when the client can still
tell you where the passwords are.

Work through it per domain. Most clients have more than one: old brand
names, country domains, the one the previous IT company registered.

## 1. Find every domain

- [ ] Ask for a list, then check it: domains in the email tenant
      (Microsoft 365 or Google Workspace accepted domains), the website,
      invoices and email signatures.
- [ ] Note which are in use for email, which for the web, and which are
      parked.

## 2. Registrar and ownership

- [ ] Which registrar, and **whose account**? It should be the client's,
      in a shared company mailbox, not a former employee's or the previous
      MSP's.
- [ ] Get access, or a named contact who has it. Record it in your
      documentation.
- [ ] **Two-factor authentication** on the registrar account.
- [ ] **Expiry date** and **auto-renew** on, with a valid card.
- [ ] **Transfer lock** on (`clientTransferProhibited`). See
      [domain status codes](/guides/clienttransferprohibited).
- [ ] Registrant contact details correct, and private in WHOIS where
      possible.
- [ ] For the domain email runs on, consider a
      [registry lock](/guides/registry-lock).

## 3. DNS

- [ ] Where is DNS hosted (registrar, Cloudflare, the web host)? Get
      access.
- [ ] Export the zone and keep a copy, so you can tell later what
      changed.
- [ ] Look for records pointing at services the client no longer uses:
      old CNAMEs to cloud apps are how
      [subdomain takeovers](/guides/subdomain-takeover) happen.
- [ ] If DNSSEC is on, note who manages the keys before anyone changes
      nameservers.

## 4. Email authentication

- [ ] **SPF**: one record, every sending service listed, within the
      [10-lookup limit](/guides/spf-too-many-dns-lookups).
- [ ] **DKIM**: on in the mail tenant and in every service that sends as
      the client. See [set up DKIM](/guides/dkim-setup).
- [ ] **DMARC**: published with a reporting address you'll read. Plan the
      move to enforcement:
      [DMARC from none to reject](/guides/dmarc-none-to-reject).
- [ ] **Parked domains**: `v=spf1 -all` and `p=reject`, so they can't be
      used to spoof the client.

## 5. Certificates

- [ ] List every hostname with a certificate from CT logs
      ([certificate finder](/tools/find-ssl-certificates)), not only the
      ones the client mentions.
- [ ] For each: where it's installed, when it expires, and whether
      renewal is automatic, automatic but installed by hand, or fully
      manual.
- [ ] Check what each host actually serves; a renewed certificate that
      was never installed looks fine until it expires.
- [ ] Add a [CAA record](/guides/caa-record) listing the CAs in use.

See [SSL certificate monitoring for MSPs](/guides/ssl-certificate-monitoring-for-msps)
for keeping this up to date.

## 6. Lookalikes and impersonation

- [ ] Check for registered lookalikes of each domain, especially ones with
      mail servers
      ([lookalike domain checker](/tools/lookalike-domain-checker)).
- [ ] Ask whether the client has had fake invoices or "change of bank
      details" emails. If so, see
      [someone is pretending to be my company](/guides/someone-is-pretending-to-be-my-company).
- [ ] Agree a rule with the client's finance team: bank details are never
      changed on the strength of an email alone.

## 7. Set up monitoring and reporting

- [ ] Monitoring for domain expiry, transfer lock, registrar and
      nameserver changes, certificate expiry, SPF and DMARC, and new
      lookalikes.
- [ ] Alerts to your team's channel, grouped by client.
- [ ] A baseline report to show the client what you found and fixed in
      the first month.

## Do the first pass in a minute

The [MSP domain security report](/tools/msp-domain-security-report)
covers the public parts of sections 2, 4, 5 and 6 (expiry, transfer lock,
SPF, DMARC, certificates and lookalikes) from public data, and gives you a
shareable report for the kickoff meeting. The MSP plan keeps the
monitoring in section 7 running for up to 25 clients, with alerts and a
monthly white-label report.

---
Source: https://nameward.app/guides/msp-client-onboarding-domain-security-checklist (updated 2026-10-31)