Generic company lists tell you who exists. Qualified MSP prospecting explains why an account deserves a conversation and what you should ask next.
Start with the service you want to sell
A managed service provider rarely wins by emailing every business in a region. Start with a service hypothesis: Microsoft 365 administration, email-security management, DMARC implementation, cloud migration or outsourced help desk. Then describe the buyer who can approve it, the company size you can serve and the operational trigger that would make the service relevant.
Write down exclusions before collecting leads. A five-person business may not support the economics of your managed SOC offer; a global enterprise may have a procurement process your team cannot cover. Geography, company size, sector and service fit all matter, even though not all of those attributes are visible in DNS. An infrastructure fingerprint is not a complete ideal customer profile.
Build a two-layer prospect list
Layer one is a firmographic list: company, domain, country, industry, rough size and an identifiable decision maker. Layer two is externally observable technology: email workspace evidence, MX gateway, DNS provider, SPF and DMARC policy. Keep each observation with its source and collection date so another salesperson can verify it.
| Layer | Useful examples | What it cannot establish |
|---|---|---|
| Account fit | Region, employee band, services you support | Current willingness to buy |
| Technology | Microsoft MX, gateway MX, DMARC TXT | Internal contracts or security effectiveness |
| Commercial context | Existing provider, possible policy project | That a prospect has a confirmed vulnerability |
Qualify before you personalize
For each account, answer three questions. Does it match our ICP? Is there a credible reason this service may be relevant? Can we articulate a discovery question without exaggerating public evidence? Only when all three are satisfied should the lead be promoted from collected domain to qualified prospect.
For example, a company with Microsoft 365 indicators and a monitoring-only DMARC policy can be worth asking about its enforcement roadmap. p=none does not prove a security incident, and it may be an intentional implementation stage. Your opener must respect that boundary.
Turn the account into an outreach sequence
Build a small, testable batch instead of purchasing tens of thousands of names immediately. Select one market and one service. Review the first twenty classifications manually. Then write a brief message that names the service outcome and asks a question. Do not paste raw DNS strings into cold outreach. Those belong in your preparation notes.
A reasonable message structure is: why this account fits, what your MSP specializes in, and one relevant question. Measure positive replies and booked discovery calls by segment. Volume without an answer to these questions is not a pipeline.
Two ways to operationalize the research
If you already have company domains, upload or scan them through the SecuTest prospect workflow and review the evidence. If you need new companies, use Find Leads to explore available infrastructure-based filters and obtain a scoped list. Enrich the exported domains with verified business information before contacting people. SecuTest identifies public infrastructure signals, not private buyer intent.
Measure revenue-quality signals, not list size
Track accounts researched, records with usable evidence, outreach sent, meaningful replies, discovery calls, qualified opportunities and closed revenue. Separate these by sales thesis and by data source. A low-volume list that produces relevant conversations can outperform a much larger list of unqualified addresses.
Revisit the classification when the DNS observation becomes stale. MX changes, gateway rollouts and vendor migrations can invalidate a previous pitch. A mature workflow treats freshness as part of account quality, not a cosmetic timestamp.
A practical first-week experiment
Create two small cohorts with the same market and decision-maker criteria. Cohort one is selected from basic firmographic information. Cohort two uses the same criteria but also requires a relevant, manually reviewed infrastructure signal. Send an equally useful and respectful service message to each group. Compare the share of contacts that produce substantive discussions, not simply open rates. That comparison will tell you whether technographic qualification is improving your targeting.
Track false positives separately from "not interested" replies. If a Microsoft 365 detection is incorrect, improve the rules or verification. If the detection is correct but the prospect already has a satisfactory MSP, that is commercial disqualification, not detector failure. This distinction prevents engineering work from being used as a substitute for learning how to sell.
Turn infrastructure signals into a qualified prospect list.
Analyze domains you already know, or find new companies that match the technologies you target. Public DNS observations support discovery, not proof of an internal security weakness.