Business email on your own domain: a practical setup guide.

Choose addresses around people and work

List the people who need individual accounts and the shared purposes that need an address, such as inquiries, bookings, or billing. An alias that forwards mail is not necessarily a shared inbox with its own history, permissions, or reply behavior. Confirm what the provider supports and who is responsible for each queue.

For example, a dental practice may want general scheduling messages to reach an approved front-desk workflow, while a landscaper may route estimate requests to one coordinator. Keep sensitive records out of a general inbox unless an appropriate system and policy have been reviewed. Do not create addresses simply because a larger plan makes them available.

Confirm ownership, billing, and recovery

The business should control its domain, email administration, and recovery details. Record who can add users, reset access, and approve billing changes. Google Workspace uses per-user subscription pricing, so distinguish a paid account from a forwarding address when estimating ongoing cost.

Enable multifactor authentication on supported owner and administrator accounts. CISA describes this as an additional identity check beyond a password. Keep a secure recovery path that does not depend entirely on the same mailbox being repaired. Give collaborators appropriate access instead of sharing one owner login across the team.

References: Google Workspace [1]CISA [2]

Identify every sender before changing DNS

Your daily inbox may not be the only system that sends mail using the business domain. A website form, booking platform, payment service, and newsletter provider may each send messages. Google’s SPF setup guidance recommends identifying the authorized senders before configuring the domain’s SPF record.

Ask the person doing the work to keep an inventory of current records and document changes. Do not replace a working record with a copied example without checking what it already supports. If an email migration is involved, agree how old mail, folders, aliases, contacts, and devices will be handled separately from the new mailbox setup.

References: Google Workspace Help [3]

Understand the three authentication pieces

SPF identifies authorized sending systems for a domain. DKIM attaches a signature that receiving systems can verify using the domain’s public key. DMARC adds a policy and reporting framework around authentication and alignment. These settings work together; buying a business email subscription alone does not establish every sender correctly.

Use the chosen provider’s instructions and test the result. Google recommends starting a DMARC rollout with monitoring before moving to a stronger policy as legitimate senders are checked. Do not jump to a strict rejection policy while the website or booking platform is still sending unauthenticated messages. Also remember that authentication is not a guarantee of inbox placement.

References: Google Workspace Help [3]Google Workspace Help [4]Google Workspace Help [5]

Test messages that matter to customers

Test sending and replying between the new mailbox and external addresses. Then submit the website inquiry form, make an approved test booking, and check the sender name, reply address, destination, and visible content. A message arriving in an administrator’s test inbox does not prove it reached the staff member who handles real customers.

Keep website notifications and marketing campaigns distinct in the test plan. Confirm where replies go and whether a staff member can identify the customer request without opening an unexpected attachment. Check the mobile mail setup your team actually uses rather than assuming desktop access is enough.

Plan the handoff and future changes

Ask for a short record of the provider, account owners, recovery process, configured addresses, and systems allowed to send. Record what happens when someone joins or leaves and who updates a changed booking or marketing provider. This is ongoing administration, separate from the initial task of getting mail running.

If a provider changes, review authentication again instead of leaving old sending services authorized indefinitely. Agree who monitors failures and who can approve DNS changes. At BayBold, standard email setup and care can be included in Business or Growth; historical migration and more complex work are reviewed before quoting.