Prospect Domain Audit Generator

Turn any prospect's domain into a white-labeled email security report. Check DMARC, SPF, DKIM, MTA-STS and blocklists from public DNS, add your logo and brand color, and send a PDF that opens the sales conversation.

Prospect domain

Prospect company name (optional)

DNS Server

Your brandingShown on the report cover, the contact block and the outreach email. It stays in your browser.

Your company name

Contact name

Phone

Website

Brand color

Logo (PNG, JPG, SVG, WebP or GIF, up to 1 MB)

Upload logo No file chosen

The audit reads only what the domain publishes for mail servers: its DNS records and MTA-STS policy. Nothing is scanned, and your branding never leaves your browser.

How the Prospect Domain Audit Generator Works

Build a branded email security assessment for any prospect in under a minute. The audit reads the same public DNS records every receiving mail server checks, so you can run it before the first call without access to the prospect's systems.

Enter the prospect's domain

Type the domain they send email from (e.g. prospect.com) and their company name. We check MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI and DNSSEC, the mail servers on six IP blocklists and the domain on three domain blocklists.

Add your branding

Add your company name, contact details, brand color and logo. The report cover, headings and contact block use your brand. Your logo is read in the browser and never uploaded.

Download and send

Save the report as an A4 PDF, then copy the ready-made outreach email. It sums up the top three risks in plain language and signs off with your details.

What's in the Email Security Assessment Report

The report is written for the prospect's decision maker. Every finding explains the business risk first, then gives the technical detail and fix their IT contact needs.

Score, grade and risk level

A 0 to 100 score, an A to F grade and a Critical, High, Medium or Low risk level, so the prospect sees where they stand at a glance.

Executive summary

Three to four sentences generated from the findings: the score, the most urgent risk, the issue count and the effort to fix it.

Compliance callouts

Shown when relevant: Google and Yahoo bulk sender rules (Feb 2024), Microsoft Outlook.com high-volume sender rules (May 2025) and PCI DSS v4.0 requirement 5.4.1.

Findings table

Each issue with a severity, a plain-language explanation such as "Anyone can send email that appears to come from your domain", the technical detail and the fix.

30/60/90-day remediation plan

A prioritized plan that fixes critical gaps first, then moves DMARC from p=none to p=reject and adds MTA-STS, TLS-RPT and DNSSEC.

Your brand and contact block

Your logo, color and "Next steps" contact details. PowerDMARC appears only as a small line in the footer.

How to Use the Audit in Sales Conversations

A domain audit gives you a specific, verifiable reason to start a conversation. Use it to talk about risk the prospect already has, not about products.

Lead with the risk

Open with the top finding in business terms, such as "anyone can send invoices that look like they come from you". Keep the technical detail for the IT contact.

Tie it to mandates

Point to the Google, Yahoo and Microsoft sender requirements and PCI DSS 5.4.1. Deadlines that already passed give the fix urgency without pressure tactics.

Propose a phased rollout

Offer the 30/60/90-day plan: DMARC at p=none with reporting, then quarantine, then reject. A phased plan removes the fear of blocking real email.

Offer managed monitoring

New senders and DNS changes break authentication over time. Position ongoing DMARC monitoring and alerts as a monthly managed service.

Why Email Authentication Opens Doors for MSPs

Most small and mid-sized businesses still don't enforce DMARC. That gap is visible from public DNS, easy to explain and fixable in weeks, which makes it a strong first project with a new client.

Recurring revenue

DMARC isn't a one-off fix. Reports need reviewing, new senders need authorizing and records drift. That makes it a natural monthly managed service.

Compliance-driven demand

Google, Yahoo and Microsoft now require SPF, DKIM and DMARC from bulk senders, and PCI DSS v4.0 requires anti-phishing controls. Prospects need help meeting rules they can't ignore.

Low-touch onboarding

The PowerDMARC multi-tenant platform lets you manage every client domain from one dashboard, under your own brand, with white-labeled reports and alerts.

See the MSP and MSSP partner program →

Frequently Asked Questions

Is it legal and ethical to audit a prospect's domain?

The audit only reads what a domain publishes for every mail server: its public DNS records (SPF, DKIM, DMARC and the rest) and its MTA-STS policy file. It doesn't scan ports, test logins or send email. Present the results as an offer of help, and share the report with the prospect rather than publishing it.

Can I remove the PowerDMARC branding?

The report uses your logo, name, brand color and contact details. PowerDMARC appears only as a small "Report generated with PowerDMARC" line in the footer. Partners in the MSP and MSSP program get a fully white-labeled platform and reports.

Is the prospect's data or my logo stored?

No. The domain is looked up on our server in public DNS and on the blocklists, and the result is held for about five minutes so a repeat audit is instant, then discarded. Your company name, contact details, brand color and logo never leave your browser: the logo is read with the browser's file reader and is never uploaded. Closing the page clears them.

How accurate is the DKIM check?

DKIM keys sit under selector names the sender chooses, and DNS can't list them. We probe 34 common selectors, such as google, selector1 and k1, and read the real size of every key we find. A domain that signs with a custom selector may show "No DKIM keys found at common selectors". Confirm with the headers of a recent email from the prospect before you raise it.

Which blocklists does the audit check?

The mail servers' addresses are checked against Spamhaus ZEN, SpamCop, Barracuda, Mailspike, PSBL and UCEPROTECT Level 1, and the domain against Spamhaus DBL, URIBL and SURBL. Spamhaus is asked at its own name servers, and a list's answer only counts after it answered its own test entries correctly.

How is the score calculated?

Every domain starts at 100. Each finding deducts points: 30 for critical, 15 for high, 7 for medium and 3 for low. Grades are A (90+), B (80+), C (70+), D (60+) and F (below 60). The risk level follows the most severe finding, and a score below 50 is at least High.

How do I save the report as a PDF?

Click "Download PDF" and choose "Save as PDF" in your browser's print dialog. Only the report prints, on A4 pages, and the file is named after the prospect and your company. If your brand colors are missing, turn on "Background graphics", and turn off "Headers and footers" so the page address isn't printed.

Turn audits into managed email security revenue

Join the PowerDMARC MSP and MSSP program to manage DMARC, SPF, DKIM, MTA-STS and BIMI for every client from one multi-tenant, white-label platform.

Book a demo Become a partner