How to Set Up a Professional Business Email (and Keep It Out of Spam)

A quote sent from joesplumbing1987@gmail.com works. A quote from joe@joesplumbing.com works better. Customers trust it more, it’s harder for scammers to imitate, and the account belongs to the business instead of to whoever created it.

The setup itself takes an afternoon. The part most owners skip, and later regret, is email authentication. Without SPF, DKIM and DMARC records, your carefully written invoices are more likely to land in spam or get rejected outright. Gmail, Yahoo and Microsoft’s Outlook.com now expect authentication from senders, and they enforce it most strictly on high-volume senders.

This guide walks through the whole process in order: choosing a host, connecting your domain, and publishing the 3 records that tell the world your email is really from you.

What you need before you start

• A domain name you control, such as yourbusiness.com. If you already have a website, you probably have one. Log in to your registrar or DNS host and make sure you can edit DNS records.
• An email hosting plan. This is the service that stores and sends your mail.
• A list of every service that sends email as your business, such as your website form, booking system, invoicing tool, CRM and newsletter platform. You’ll need it for SPF and DKIM.
• About 2 to 3 hours, plus time for DNS changes to take effect.

Step 1: Choose an email host

For most small businesses, the choice comes down to 2 major suites. Both include email on your domain, calendars, file storage and admin controls.

Prices change and vary by region and billing term, so confirm on the vendor’s pricing page. Whatever you choose, avoid the trap of 1 shared login for everyone. Give each person their own mailbox, and use shared addresses like hello@ or billing@ as groups or aliases that deliver to the right people.

Step 2: Verify your domain and switch on mail delivery

Every host follows the same pattern.

1. Sign up and add your domain in the admin console.
2. Prove you own it. The host gives you a TXT record to add in your DNS settings. Once it appears, the host confirms ownership.
3. Create mailboxes for each person and any shared addresses.
4. Add the MX records. MX records tell the internet where to deliver mail for your domain. Your host gives you the exact values. Remove old MX records that point elsewhere, unless you’re migrating carefully.
5. Wait and test. DNS changes can take anywhere from minutes to about 48 hours to spread. Send a test from a personal account to your new address, and reply back.

If you’re moving from an old provider, import existing mail before you switch MX records, or use the host’s migration tool, so nothing gets lost.

Step 3: Publish an SPF record

SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email for your domain. Receiving servers check it to spot forgeries.

A basic SPF record looks like this:

• Google Workspace: v=spf1 include:_spf.google.com ~all
• Microsoft 365: v=spf1 include:spf.protection.outlook.com -all

Then add an include: for every other service that sends as your domain, using the exact value each provider gives you.

3 rules that trip people up:

• Only 1 SPF record per domain. RFC 7208, the SPF standard, says multiple SPF records aren’t allowed. Combine everything into a single record.
• Stay under 10 DNS lookups. The standard caps mechanisms like include, a and mx at 10 lookups in total, including nested ones. Go over and SPF fails. If you use a lot of tools, ask whether some can send from a subdomain such as mail.yourbusiness.com.
• End with ~all or -all. These tell receivers to treat other senders as suspicious or fail them. Never use +all.

Step 4: Turn on DKIM signing

DKIM (DomainKeys Identified Mail) adds a digital signature to every message. Your host keeps a private key, and you publish the matching public key in DNS. Receivers check the signature to confirm the message wasn’t forged or altered.

• Google Workspace: in the Admin console, go to Gmail, then Authenticate email, and generate a key. Google recommends 2048-bit keys if your DNS host supports them, with a 1024-bit fallback. Add the TXT record it gives you, usually at google._domainkey, then click Start authentication. Google notes that newly activated Gmail accounts may need to wait 24 to 72 hours before the key is available.
• Microsoft 365: in the Microsoft Defender portal’s email authentication settings, enable DKIM for your domain and add the 2 CNAME records it provides.
• Other senders: your newsletter platform, CRM and booking tool usually have their own “authenticate your domain” steps. Do them. Otherwise their messages may be signed with the vendor’s domain instead of yours.

Key takeaway: SPF says which servers may send for you, DKIM proves each message is genuine, and DMARC tells receivers what to do when a message fails. You need all 3, and every tool that sends as your domain has to be included, not just your main mailbox.

Step 5: Add a DMARC record and tighten it over time

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM to the address customers see in the From line. It also sends you reports showing who’s sending mail using your domain. In May 2026, the IETF published an updated DMARC specification as RFC 9989, a Proposed Standard that replaces the older RFC 7489. Existing records keep working, and they still start with v=DMARC1.

Add a TXT record at _dmarc.yourbusiness.com. Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com

Then follow a staged rollout:

1. Weeks 1 to 4, p=none: collect reports. They’re XML files, so a free or low-cost DMARC report viewer helps. Look for legitimate services that fail and fix their SPF or DKIM.
2. Next, p=quarantine: failing mail goes to spam. Some owners start with pct= set to a portion of mail, then raise it.
3. Finally, p=reject: receivers refuse mail that fails. This gives the strongest protection against people impersonating your domain.

Monitoring mode is enough to meet the big mailbox providers’ baseline. Google’s sender guidelines say bulk senders, those sending around 5,000 or more messages a day to personal Gmail accounts, must have SPF, DKIM and DMARC, and that a policy of none is acceptable. All other senders need at least SPF or DKIM. Microsoft applies similar requirements to domains sending 5,000 or more messages to Outlook.com and its other consumer services, and rejects non-compliant mail. Moving toward quarantine or reject is still worth it, because it’s what actually stops spoofing.

Step 6: Lock down the accounts

A business inbox is a prime target. Business email compromise, where criminals take over or imitate an account to redirect payments, drew more than $3 billion in reported losses in 2025, second only to investment fraud, according to the FBI’s Internet Crime Complaint Center. Our guide to business email compromise explains how it works.

• Turn on multi-factor authentication for every mailbox, starting with admin accounts. See how to set up two-factor authentication.
• Keep admin accounts separate from daily-use accounts.
• Disable automatic forwarding to outside addresses unless there’s a business reason. Attackers use it to quietly copy your mail.
• Remove access on day 1 when someone leaves.

Microsoft 365 users should also work through our Microsoft 365 security guide.

Where to start: a 1-afternoon checklist

To check your work, send a message to a personal Gmail account, open it, and choose “Show original.” You should see SPF, DKIM and DMARC listed as PASS. For deeper reading, see SPF, DKIM and DMARC explained and our email deliverability guide.

Conclusion

Professional business email is 2 jobs. The first, getting mail working on your domain, takes an hour or 2 with any major host. The second, authenticating it with SPF, DKIM and DMARC, is what keeps your messages out of spam and stops others from sending fake email in your name. Do both on the same afternoon, turn on MFA, and set a reminder to tighten DMARC once the reports look clean.

Sources

• Google Workspace Help: Compare Flexible and Annual/Fixed-Term payment plans — Business Starter pricing by plan
• Google: Email sender guidelines — SPF, DKIM and DMARC requirements for all and bulk senders
• RFC 7208: Sender Policy Framework — single SPF record and 10-lookup limit
• RFC 9989: DMARC — current DMARC standard, obsoleting RFC 7489
• FBI IC3: 2025 Internet Crime Report — business email compromise losses in 2025
• Microsoft Support: Fix NDR error 550 5.7.515 in Outlook.com — high-volume sender requirements for Microsoft consumer email