Business email on your own domain, and why it matters

An address such as [email protected] uses your domain. A personal address ending in a provider's name belongs to that provider's domain. A custom-domain address can stay the same if your business changes its email service, provided you keep the domain and configure the new service correctly.

That continuity matters when the address is printed on signs or saved in customers' contacts. Role addresses such as hello@ or bookings@ can also avoid making the public contact address depend on one employee's name. Decide who reads them and how cover works when that person is away.

Your website and email do not have to use the same hosting company. Keep the domain registered for your business, maintain its renewal and record who controls the email administrator account. If the domain stops working, its email can stop too.

A mailbox stores messages and provides an account for reading and sending them. An alias is another address that delivers into an existing mailbox. Forwarding passes incoming messages to a different address. Check which of these you are buying, rather than assuming every custom address is a separate inbox.

Forwarding can suit a small setup, but check how you will reply. Receiving mail at your own-domain address does not automatically set up authenticated outgoing mail from that address. Otherwise, a reply may expose your personal address or use a sending route that has not been authorised.

If several staff handle enquiries, look for shared-mailbox or delegated-access features that let them sign in with their own accounts. Do not solve shared access by giving everyone the same password. Check the provider's current features, account recovery and billing before deciding.

Sam at fictional Acme Ltd uses [email protected] for enquiries and [email protected] for billing. If both are aliases of Sam's mailbox, they do not create two separate staff logins. A second person needs their own access arrangement, not Sam's password.

DNS is the set of records that tells other systems where to find services for your domain. MX records direct incoming email to your email provider. Other records direct visitors to your website. Changing one does not require replacing every record in the account.

SPF, DKIM and DMARC are separate email authentication settings. They help receiving systems check outgoing messages. They do not create a mailbox, renew your domain or guarantee that a message reaches the inbox.

Use the records supplied by your actual provider and keep a copy of the existing settings before editing them. If you are changing providers, plan mailbox setup and any old-message transfer before changing the incoming-mail records. Ask your email provider or web person to help if you are unsure which records belong to which service.

SPF stands for Sender Policy Framework. Think of it as a published list of the mail systems allowed to send for a domain. The receiving system checks the sending server against that list. SPF checks the domain used behind the scenes for sending, which can differ from the address the customer sees.

Your mailbox provider may not be the only sender. A booking system, invoicing tool, newsletter service or website form can send mail too. Ask each supplier what authentication setup it needs. Include every service that needs authorisation, using its instructions rather than guessing.

Google's guidance says a domain must have only one SPF record covering its authorised senders. Adding a second SPF record for a new supplier can break authentication. Have the existing record updated correctly instead, and remove authorisation for services you no longer use.

DKIM stands for DomainKeys Identified Mail. Your sending service adds a digital signature to a message. A receiving service checks it using a public key published in your DNS. This helps it check that the signed parts have not changed and that the signing domain authorised the signature.

You do not have to create the signature yourself. Your provider supplies the setup instructions and DNS records. You may also need to enable signing in its control panel. Publishing a record without completing the provider's setup is not necessarily enough.

Check DKIM for each service that sends mail, not just the everyday mailbox. DKIM authenticates a signature. It does not encrypt the message or prove that every link or attachment is safe.

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It checks whether successful SPF or DKIM authentication matches the domain in the visible From address. This match is called alignment. A message needs at least one successful, aligned check to pass DMARC.

Your DMARC policy tells receivers what you would like them to do with messages that fail. A policy of none requests monitoring without requesting a block. Quarantine asks for suspicious mail to be treated as spam. Reject asks for it to be refused. Receivers still apply their own checks and policies.

Reports can show which systems are sending for your domain and where authentication is failing. Arrange somewhere to receive and review them. Starting with a monitoring policy can help find genuine senders that need fixing before you request stricter treatment.

Do not switch straight to reject without checking your invoice, booking, website and newsletter senders. A strict policy can block genuine business mail if those services are not configured correctly. A monitoring policy helps you investigate, but is not the same as asking receivers to block impersonation.

These rules concern the people receiving your messages. You do not have to use Gmail or Yahoo yourself for them to matter. If a customer uses either service, its receiving system can reject your message or put it in spam when it does not meet the requirements.

Google requires all senders to personal Gmail accounts to use SPF or DKIM. Yahoo also requires at least one of those checks for all senders. Both have stronger requirements for bulk senders, including SPF and DKIM together, plus DMARC with alignment. Authentication is only part of their rules. Sending unwanted mail can still cause delivery problems.

Google's FAQ defines bulk sending as close to 5,000 messages or more to personal Gmail accounts in a 24-hour period, counting the same main domain and its subdomains together. Reaching that level once gives permanent bulk-sender status. Yahoo's requirements page does not publish the same fixed numerical threshold.

Bulk marketing and subscription messages also need an easy unsubscribe route, including the providers' one-click requirements. Ask your mailing service to confirm how it meets them. A small business sending ordinary replies still needs the basic authentication checks, even if it never sends a large campaign.

These requirements were checked on 13 October 2026. Using SPF, DKIM and DMARC together is a sensible setup for business email below the bulk threshold too. It does not guarantee inbox placement, but avoids relying on only one authentication method.

Start with a list of every service that sends using your domain. Ask your provider to confirm SPF, DKIM and DMARC, including alignment for those services. You do not need to send anyone your mailbox password to ask for this information.

A successful test is useful evidence, not a promise that every future message will reach every inbox. Keep sending relevant mail to people who expect it, and investigate repeated bounces or spam-folder reports rather than treating authentication as the whole answer.

• Check the domain's renewal, email administrator access and recovery details. Protect important accounts with passkeys where available, or a strong unique password and two-step verification.
• Send harmless tests from your mailbox and each automated sending service to Gmail and Yahoo accounts you control. Check receipt, the visible sending address and whether replies reach the right mailbox.
• In Gmail on the web, open a test message and use the menu beside Reply to choose Show original. Ask your provider to check the authentication results if you do not understand them.
• Check the address shown on your website, its email links and the destination for form notifications. Updating your mailbox does not automatically update the website.
• Keep the existing mailbox available during an address change, and agree how to preserve old messages before cancelling anything.
• Repeat the checks after adding a sending service or changing email provider. Keep delivery errors and timestamps so support can investigate a failed message.