# Client Posture

> Client Posture is white-label security scanning for MSPs. Grade any domain, send a branded Security Brief, and win a Good / Better / Best proposal online. Includes an insurance readiness questionnaire, Policy library, and MCP server.

Client Posture runs a passive external posture check on any client or prospect domain. It reads public information only: DNS, certificate transparency logs, domain registration (RDAP), and one normal homepage request. It does not run port scans, login attempts, or vulnerability probes. It is a point-in-time passive check, not a penetration test, vulnerability scan, or compliance certification.

The scan runs 17 passive checks. Email: SPF, DKIM, DMARC, DMARC reporting and BIMI, MTA-STS, TLS reporting, mail provider, email platform detection, and email filtering. Website: TLS certificate, HTTPS redirect, security headers, and software banners. Domain: DNSSEC, CAA, and expiry. Plus hostnames listed in public certificate logs.

MSPs send the results as a branded report or a Security Brief under their own logo, then turn findings into a Good / Better / Best proposal the client accepts online. Client Posture does not process the client's payment. Insurance readiness answers are labeled by source and are not insurance advice.

Plans: Free (1 client domain, watermarked reports), Starter ($199/mo or $1,990/yr, 25 client domains), Pro ($399/mo or $3,990/yr, 150 client domains), and a one-time Founding Partner offer ($1,999 once, 50 client domains, closes Dec 15, 2026 or when 50 seats are claimed). Every new workspace starts with a 7-day Pro trial with no card and no auto-charge. Proposals and the Service Library require Pro. Prices in USD.

## Product

- [Client Posture](https://www.clientposture.com/): Turn any domain into a signed client. Free passive scan, a branded Security Brief, and a Good / Better / Best proposal your client accepts online. Built for MSPs.
- [Sample report](https://www.clientposture.com/sample-report): See the branded report your clients get: a grade, plain-English findings, evidence, and fixes. Fictional MSP and client. Then scan your own prospect free.
- [Sample Security Brief](https://www.clientposture.com/sample-brief): See a sample Security Brief: a short branded summary with a grade, plain-English findings, a projected grade, and a booking link. Fictional MSP and prospect.
- [Security](https://www.clientposture.com/security): How Client Posture handles hosting, auth, payments, passive scanning, and data protection — without fake certifications.
- [Contact](https://www.clientposture.com/contact): Questions about Client Posture, billing, or your account? Support email and mailing address.

## Pricing

- [Pricing](https://www.clientposture.com/pricing): Client Posture pricing: Starter $199/mo, Pro $399/mo, and a one-time Founding Partner offer ($1,999, 50 seats, locked $299/mo Pro upgrade). 7-day Pro trial, no card.

## Free tools

- [Free email security tools](https://www.clientposture.com/tools): Ungated DMARC, SPF, and DKIM checkers plus an email grade and cyber-insurance email questions. Same engine as Client Posture. No email required for results.
- [Free DMARC checker](https://www.clientposture.com/tools/dmarc-checker): See whether a domain’s DMARC record is monitor-only or enforcing. We parse p=, t=, and rua (pct is historic), then give the next DNS record and the none → quarantine → reject path.
- [Free SPF checker](https://www.clientposture.com/tools/spf-checker): Count every DNS lookup toward the RFC 7208 limit of 10, name the services in the include chain, and get a flatten or cleanup suggestion when the record would void.
- [Free DKIM checker](https://www.clientposture.com/tools/dkim-checker): Probe common DKIM selectors plus one you type. A miss is Unknown, not a fail. We report RSA key length and which provider each selector belongs to.
- [Email security grade](https://www.clientposture.com/tools/email-security-grade): One transparent grade from verified SPF, DKIM, DMARC, and MX. See points per check, the three fixes to do first, and a shareable result with an OG image.
- [Cyber insurance email controls](https://www.clientposture.com/tools/insurance-email-controls): Map public DNS to the email questions carriers actually ask. Every answer is Verified, Unknown, or Not tested, with a paste-ready evidence line. Not insurance advice.

## Guides

- [The First 90 Days: free MSP security playbook](https://www.clientposture.com/playbook): A free week-by-week playbook for MSPs: launch a security practice without hiring a security person. Scripts, checklist, and example pricing.
- [Playbook Week 1 — Look the part](https://www.clientposture.com/playbook/week-1): Week 1 of The First 90 Days, a free MSP security playbook: scan and fix your own domain, brand every template, and build a short menu you can deliver.
- [Playbook Week 2 — Baseline your existing clients](https://www.clientposture.com/playbook/week-2): Week 2 of The First 90 Days: run the same external check on every client domain, sort by verified fails, and send each client a short, no-pressure report.
- [Playbook Week 3 — Build a prospect list](https://www.clientposture.com/playbook/week-3): Week 3 of The First 90 Days: list 25–50 local businesses, check each with public data, rank by the work the findings open up, and pick your top 10.
- [Playbook Week 4 — Send short security briefs and follow up fast](https://www.clientposture.com/playbook/week-4): Week 4 of The First 90 Days: send your top 10 prospects a one-page brief, call the day they open it, and start 2–3 clients on insurance renewal prep.
- [DMARC p=none: What It Means and How to Reach Reject](https://www.clientposture.com/guides/dmarc-p-none): DMARC p=none only monitors. Learn the real risk, how rua and ruf reports work, what changed with pct in RFC 9989, and a safe path to quarantine and reject.
- [SPF PermError: Too Many DNS Lookups (10-Lookup Limit Fix)](https://www.clientposture.com/guides/spf-too-many-dns-lookups): Why SPF hits permerror past 10 DNS lookups or 2 void lookups (RFC 7208), how to count them, and fixes: drop unused includes, use subdomains, flatten.
- [Microsoft 365 SPF Record: include:spf.protection.outlook.com](https://www.clientposture.com/guides/spf-microsoft-365): The correct Microsoft 365 SPF record, when to use -all, GCC High and 21Vianet variants, merging other senders into one record, and why not to flatten it.
- [Google Workspace SPF Record: include:_spf.google.com](https://www.clientposture.com/guides/spf-google-workspace): The Google Workspace SPF record, merging other senders into one TXT record, ~all vs -all, the 10-lookup limit, and the DKIM and DMARC steps that come next.
- [Zoho Mail SPF Record: include:zohomail.com and Regions](https://www.clientposture.com/guides/spf-zoho-mail): The Zoho Mail SPF include, why the value can depend on your Zoho data center, include:one.zoho.com for multiple Zoho apps, and merging into one record.
- [Cyber Insurance Email Controls: MFA, DMARC, SPF and DKIM](https://www.clientposture.com/guides/cyber-insurance-email-controls): What cyber insurance applications commonly ask about email security (MFA, DMARC, SPF, DKIM, filtering), quoted from insurer forms, and how MSPs can help.
- [Amazon SES SPF Include: Custom MAIL FROM Setup Guide](https://www.clientposture.com/guides/amazon-ses-spf-include): Why include:amazonses.com goes on a custom MAIL FROM subdomain, not your apex, plus the MX record SES needs and how SPF and DKIM align for DMARC.
- [At-Bay Cyber Application: Email Security Questions (06/2026)](https://www.clientposture.com/guides/at-bay-cyber-insurance-email-controls): What At-Bay's Cyber Short Application (AB-CYB-SAP 06/2026) asks about email: domains, MFA on all email access, and an optional email gateway question.
- [Beazley Ransomware Supplement F00765: Email Questions](https://www.clientposture.com/guides/beazley-cyber-insurance-email-controls): What Beazley's ransomware supplemental form F00765 (052022 ed.) asks about incoming email, DKIM, SPF, DMARC, web email MFA and legacy protocols, for MSPs.
- [Chubb Australia Cyber Proposal Form (11/2023): Email](https://www.clientposture.com/guides/chubb-cyber-insurance-email-controls): What Chubb Australia's Short MarketPlace Cyber Proposal Form (Published 11/2023) asks about email security and MFA, and how MSPs can help clients answer.
- [Corvus Smart Cyber Application v3.2: Email Questions](https://www.clientposture.com/guides/corvus-cyber-insurance-email-controls): What the Corvus Smart Cyber Insurance Application (Version 3.2, September 2024) asks about email filtering, secure email gateways, MFA and payment checks.
- [DKIM Body Hash Did Not Verify: What Changed the Message](https://www.clientposture.com/guides/dkim-body-hash-did-not-verify): 'Body hash did not verify' means the body changed after signing. Usual culprits: footers, disclaimers, lists, re-encoding. How to find the hop and fix it.
- [DKIM Signature Did Not Verify: Causes and How to Fix It](https://www.clientposture.com/guides/dkim-signature-verification-failed): What 'DKIM signature verification failed' means under RFC 6376, how it differs from a body hash failure, and the key, DNS and header causes to check first.
- [DMARC Fail: SPF and DKIM Pass but Not Aligned (Fix Guide)](https://www.clientposture.com/guides/dmarc-fail-not-aligned): Why mail fails DMARC when SPF and DKIM both pass: identifier alignment under RFC 9989, how to read the headers, and the usual fixes for SaaS senders.
- [DMARC p=quarantine: What It Means and When to Use It](https://www.clientposture.com/guides/dmarc-p-quarantine): What DMARC p=quarantine asks receivers to do, how it differs from none and reject, testing with t=y under RFC 9989 (pct is historic), and a safe rollout.
- [HubSpot SPF Include: Connecting an Email Sending Domain](https://www.clientposture.com/guides/hubspot-spf-include): HubSpot generates an account-specific SPF include, two DKIM CNAMEs, an MX and a DMARC record. Where each goes, how to merge SPF, and what to verify.
- [Mailchimp & Mandrill SPF Include: What the Docs Say Now](https://www.clientposture.com/guides/mailchimp-spf-include): Mailchimp's current setup asks for 2 DKIM CNAMEs and a DMARC record, not an SPF include. Mandrill's DKIM CNAMEs and custom return-path, explained.
- [Mailgun SPF Include: include:mailgun.org Setup Guide](https://www.clientposture.com/guides/mailgun-spf-include): Mailgun's documented SPF record, where it goes, the DKIM, MX and tracking records beside it, and why include:mailgun.org costs more lookups than it looks.
- [Mimecast SPF Include: Regional _netblocks Records Explained](https://www.clientposture.com/guides/mimecast-spf-include): Which Mimecast SPF include to use by region, why the global _netblocks include costs extra lookups, the newer mimecastprotect.com records, and the mx trap.
- [No DMARC Record Found: What It Means and How to Fix It](https://www.clientposture.com/guides/no-dmarc-record-found): Why a checker says 'no DMARC record found': missing _dmarc TXT, duplicate records, bad v= tag, or a DNS error. What RFC 9989 says, and a safe first record.
- [Postmark SPF Include: Why You Use a Return-Path Instead](https://www.clientposture.com/guides/postmark-spf-include): Postmark says you no longer need it in your SPF record. Here's the custom Return-Path CNAME that gives aligned SPF, and why include:spf.mtasv.net won't.
- [Proofpoint Essentials SPF Record: dispatch vs _spf Include](https://www.clientposture.com/guides/proofpoint-spf-include): Proofpoint Essentials SPF for outbound relay: the a:dispatch-us entry in Proofpoint's guides, the newer _spf-us include in live DNS, and how to merge them.
- [QuickBooks SPF Include: Why Intuit Doesn't Publish One](https://www.clientposture.com/guides/quickbooks-spf-include): QuickBooks Online sends invoices via Intuit or a connected Gmail account. Intuit documents no SPF include. What to check, and why not include:intuit.com.
- [Salesforce SPF Include: _spf.salesforce.com and DMARC](https://www.clientposture.com/guides/salesforce-spf-include): Salesforce's documented SPF entry is include:_spf.salesforce.com, but default bounce settings stop SPF aligning. Why DKIM is Salesforce's preferred fix.
- [SendGrid SPF Include: Automated Security vs Manual Setup](https://www.clientposture.com/guides/sendgrid-spf-include): When SendGrid needs include:sendgrid.net and when its CNAMEs handle SPF for you, where the record goes, and how it aligns for DMARC. Per Twilio docs.
- [SPF PermError: Multiple Records, Syntax Errors and Fixes](https://www.clientposture.com/guides/spf-permerror): SPF permerror beyond the lookup limit: two v=spf1 records, syntax typos, bad ip4 ranges, dead includes, duplicate redirects. What RFC 7208 says, and fixes.
- [SPF Softfail vs Fail: ~all or -all, and What Receivers Do](https://www.clientposture.com/guides/spf-softfail-vs-fail): SPF softfail (~all) vs fail (-all) per RFC 7208: what each result tells a receiver, how DMARC treats them, why -all can bypass DMARC, and which to pick.
- [Travelers MFA Supplement CYB-14306: Email Questions](https://www.clientposture.com/guides/travelers-cyber-insurance-email-controls): What the Travelers Multi-Factor Authentication Supplement, CYB-14306 Rev. 03-23, asks about email and admin MFA, how answers work, and how MSPs can prep.
- [Zendesk SPF Include: include:mail.zendesk.com Explained](https://www.clientposture.com/guides/zendesk-spf-include): Zendesk's recommended SPF record, the first-layer rule, outdated includes to replace, and the DKIM CNAMEs that let support mail pass DMARC.

## Comparisons

- [Client Posture comparisons](https://www.clientposture.com/compare): How Client Posture's passive external checks compare with Network Detective Pro, ConnectSecure and Galactic, and when to use each.
- [Client Posture vs Network Detective Pro](https://www.clientposture.com/compare/network-detective): Client Posture vs Network Detective Pro (RapidFire Tools, a Kaseya company): passive external checks vs deep internal network scanning. When to use each.
- [Client Posture vs ConnectSecure](https://www.clientposture.com/compare/connectsecure): Client Posture vs ConnectSecure (CyberCNS): passive checks and Briefs vs agent- and probe-based vulnerability management, external scanning and patching.
- [Client Posture vs Galactic](https://www.clientposture.com/compare/galactic): Client Posture vs Galactic (galacticsecurity.com, formerly galacticscan.com): passive external checks vs pentesting and vulnerability assessments.

## Integrations and MCP docs

- [Integrations](https://www.clientposture.com/integrations): What Client Posture connects to today: HubSpot, HaloPSA, signed outbound webhooks, a Zapier-ready REST API, MCP for your AI assistant, CSV import and export, and branded PDFs. Plus an honest roadmap.
- [MCP server](https://www.clientposture.com/docs/mcp): Connect your own AI assistant to Client Posture through MCP. Per-person API keys. Pro can read scans and draft quotes; Founding Partner gets the same tools except quote drafts. We host no model. 18 read tools, 4 act tools, and 4 prompts.
- [Verifying webhooks](https://www.clientposture.com/docs/webhooks): Verify Client Posture webhook signatures with HMAC-SHA256. Timestamp + body, 5-minute replay window.

## Legal

- [Terms of Service](https://www.clientposture.com/terms): Terms for using Client Posture: accounts, acceptable use, Founding Partner, refunds, and the 7-day Pro trial. Client Posture is a product of InfoDefenders, LLC.
- [Privacy Policy](https://www.clientposture.com/privacy): How Client Posture collects, uses, and retains account, scan, and billing data.

## Optional

- [Sitemap](https://www.clientposture.com/sitemap.xml): Every public marketing page, guide, comparison, and tool.