Making the case — Domain Trust Architecture

The work needs someone’s agreement, and the argument that gets it is not the one that frightens them. Fear produces a single approval and no durable support; evidence produces both.

What persuades

Evidence	Why it works
A count of spoofing attempts from your own aggregate reports	Specific, about this organisation, and not arguable. It is why rua comes first.
A live demonstration of sending as the domain	Ends the question of whether the exposure is theoretical. Use a domain you own, never the live one, and only with agreement.
The list of forty unprotected domains carrying the brand	Concrete, countable, and cheap to fix — which makes the first ask an easy yes.
What it costs, honestly, including the vendor that gates it	Naming the constraint makes the estimate credible and moves the decision to someone who can make it.
What you are not asking for	A request that excludes BIMI and registry lock reads as considered rather than as a wish list.

What does not

Industry breach statistics. About other organisations, and the listener knows it.
Vendor percentages. They will be quoted back at you when they do not hold.
Compliance framing alone. It gets a minimum implementation that satisfies an auditor and protects nothing — p=none with a checkbox next to it.
Overstating scope. Claiming this stops phishing buys approval now and costs credibility at the first incident it could never have prevented.

Ask in two parts

Part one: the free work
   "A day of my time, no budget, no risk. Registrar MFA,
    reporting on every domain, and forty parked domains
    locked down."
   -> Almost always approved, and it produces the
      evidence for part two.

Part two: the funded work
   "Two to three weeks of effort over two quarters, one
    vendor tier upgrade at £X, to reach enforcement on
    the primary domain."
   -> Asked six weeks later, with your own numbers.

Splitting it means the second ask is made with evidence from your own estate rather than with an argument. It also means something has shipped before anyone is asked for money.

When the answer is no

Do the free work anyway. It was never the part that needed approval.
Record the decision and its reason. Not as a defensive measure — as the thing you revisit when the circumstances change.
Name the trigger. “Revisit if we see a spoofing campaign, if a customer asks, or at the next renewal” converts a refusal into a deferral.
Keep the reporting running. When the trigger arrives you will have a year of evidence and the conversation will take ten minutes.

Do not demonstrate spoofing against the live domain

It is persuasive, it is also sending a forged message inside an organisation, and it reliably ends badly — a recipient forwards it, or it reaches someone who was not in the room. Use a domain you own and control that sits at p=none, send to yourself, and agree it in advance with whoever would be asked about it afterwards.

Knowledge check

Why split the ask into free work and funded work?

The free work is almost always approved, ships immediately, and produces the evidence from your own estate that makes the funded ask persuasive.
Because approvers prefer smaller requests.
Because the free work satisfies compliance on its own.
Because the funded work cannot start until the free work is finished.

Correct — The free work is almost always approved, ships immediately, and produces the evidence from your own estate that makes the funded ask persuasive. Reporting has to be running before anyone can say how much spoofing this organisation actually sees. Asking for budget first means arguing from industry statistics, which the listener knows are about somebody else.

Not this — Because approvers prefer smaller requests. Sometimes, and the substantive reason is that the first part generates the evidence for the second.

Not this — Because the free work satisfies compliance on its own. Compliance framing tends to produce a minimum implementation that protects nothing.

Not this — Because the funded work cannot start until the free work is finished. Partly true through the reporting dependency, and the reason to split the ask is persuasion rather than sequencing.