This sequence is a composite scenario. No client stands behind it, no name in it is real, and its numbers are scenario detail rather than results we’d claim.
The situation
The sender is a managed IT provider with 23 law firms on its books. The reader is the managing partner of a firm with 14 lawyers. They’ve used the same IT person for 9 years, and they’ve had no outage this year.
Most IT pitches to law firms open on ransomware and end on a 15-minute call. We took both out. We also took out any lecture on ethics rules, because the reader knows those rules better than the sender does.
That leaves one fact the reader can check in 10 seconds: a public DNS record on the firm’s own domain. It decides what a receiving mail server should do with a forged email under the firm’s name. A firm that emails wire instructions already knows why that matters.
Five emails run over 21 days, and every body stays between 60 and 110 words. None of the 5 asks for a call, and 2 of them give the work away. Subject options and send logic come with it, the way we ship any email sequence.
Email 1 - the record
Subject lines
- DMARC on [firm domain]
- who can send mail as [firm domain]
- [firm domain] and your wire instructions
Body
Hi [First name],
[firm domain] publishes [no DMARC record / a DMARC record set to p=none]. That’s public DNS, and it takes 10 seconds to check. As it stands, nothing tells a receiving server to reject mail forged under your firm’s name.
It matters most the day the firm emails wire instructions for a closing or a settlement.
We ran 4 public checks on [firm domain], with no login and nothing from inside the firm. Reply “send” and the results come back on one page. Ours is set to p=reject, if you’d like to look us up.
[Your name]
Send: Day 0, Tuesday, before 8 am their time. Why this email exists: the reader can verify the claim without trusting us, and the ask is one word.
Email 2 - the IT person
Subject lines
- for whoever runs your email
- the DMARC fix, in 1 line
- you already have someone for this
Body
Hi [First name],
Most firms your size have one IT person they trust. We aren’t writing to change that.
Forward this to yours. It’s the fix for [firm domain], one TXT record at _dmarc:
v=DMARC1; p=none; rua=mailto:[mailbox]That starts the reports and blocks nothing. The reports show every system that mails as the firm, billing and e-signature included. Once those all pass, they can move it to p=reject.
It’s 5 minutes of their time, and you don’t owe us anything for it.
[Your name]
Send: Day 4. Why this email exists: “we have someone” is the likeliest brush-off, so this one works through that person instead of around them.
Email 3 - the signature
Subject lines
- the form a partner signs at renewal
- 14 lines for your next security questionnaire
- what counts as a yes on MFA
Body
Hi [First name],
Two documents want a straight answer about your firm’s IT. A partner signs the cyber insurance application. A corporate client sends the security questionnaire, usually with a short deadline.
They ask the same things in different words: MFA on every account, tested backups, encrypted laptops, a written incident plan. A yes that’s only mostly true causes trouble on both, and one of them carries a signature.
We keep a 14-line worksheet of those questions, with what counts as a yes on each. An IT person can fill it in within an hour. Reply “worksheet” and it’s yours.
[Your name]
Send: Day 9. Why this email exists: it moves IT from a cost line to a document with a partner’s name on it.
Email 4 - the access
Subject lines
- what your IT provider can open
- 6 questions for any IT provider
- admin rights and client files
Body
Hi [First name],
Whoever holds admin rights at your firm can reach most of what it stores. That goes for your current provider, and it would go for us. You know your state’s version of Rule 5.3 better than we do, so we’ll stick to our side of it.
We wrote 6 questions for any IT provider, us included. Who holds admin rights, by name. Where the access logs live. What the confidentiality terms say. What happens to access the day a contract ends. There are 2 more.
Reply “6” and they’re with you today.
[Your name]
Send: Day 15. Why this email exists: a lawyer will raise this objection to any vendor, so we raise it first and put the sender under the same test.
Email 5 - the handover
Subject lines
- your 4 results for [firm domain]
- 4 lines on [firm domain]
- last one, with the results
Body
Hi [First name],
Here are the 4 results I offered. No reply needed.
- DMARC: [status]
- SPF: [status]
- Website certificate expires: [date]
- Domain registration expires: [date]
Your IT person can confirm all 4 in a few minutes, since all 4 are public. This is the last email from us. If you ever want a second opinion, you have my address.
[Your name]
Send: Day 21. Why this email exists: most sequences end by asking once more. This one ends by handing over what it offered, and the last thing the reader sees from the sender is useful.
The send logic
Who gets it. The team runs the DNS lookup first. A firm already at p=reject stays off the list, because email 1 would be false. A firm at p=none gets the second half of email 2, the move to p=reject, with the record line left out. The checks run again before email 5, so a firm that made the fix sees it reported.
What a reply does. Any reply stops the sequence. “Send”, “worksheet” or “6” gets the asset inside 1 working day, with one line offering a 20-minute review of the results. “We have someone” gets a thank-you and nothing else.
What goes out first. The sender’s own domain passes all 4 checks before day 0, because a lawyer will look. Every email carries a postal address and an opt-out line, in the wording the sender’s counsel sets. An opt-out goes on the suppression list the same day.