Why the free address costs you
A business quoting four figures from a gmail.com or hotmail.com address is making the customer do extra work to believe them, at precisely the moment they are deciding whether to.
There is a more practical reason too, and it bites later. An address you do not control is an asset you cannot hand over, cannot audit, and cannot recover if the person holding it leaves. Businesses discover this at the worst possible moment: when the relationship ends.
The same applies to an address at your broadband provider — anything ending in a provider's domain. Change provider and you lose the address, with every account, invoice and customer thread attached to it.
What you want is an address at a domain you own, in a mailbox you administer, that you could move to a different provider tomorrow without telling a single customer.
Choosing where the mailbox lives
Three realistic options, and the decision is less important than people fear because you can move later.
Google Workspace or Microsoft 365
Where most businesses end up. A few pounds per user per month, proper spam filtering, calendars and files included, and — the reason that matters most — somebody to call when mail stops. Microsoft 365 suits a business already living in Outlook and Excel; Google Workspace suits one already on Gmail and Docs. Both are fine. The argument is not worth a week.
Mailbox hosting from your web host
Often included with hosting and often adequate for one or two addresses. The trade-off is that spam filtering and deliverability tend to be weaker, and your email is now tied to the company that hosts your website — so moving the site means moving the mail on the same day, which is an avoidable complication.
A dedicated email host
Cheaper than the big two, no documents or calendar, perfectly good mail. Reasonable for a sole trader who wants a proper address and nothing else.
What is not an option: forwarding your business address to a personal Gmail and replying from the Gmail. The reply goes out from the personal address, which defeats the whole exercise and looks worse than never having set it up.
The three records that decide whether it arrives
This is the half nobody mentions, and it is the half that costs money. Email authentication has tightened considerably — the large mailbox providers now expect it from anyone sending them mail in any volume, and unauthenticated mail increasingly goes to spam or is rejected.
You will not get a bounce you understand. You will get silence, and conclude the customer ignored you.
SPF
A DNS record listing which servers are allowed to send email as your domain. Your mailbox provider gives you the value. The common mistake is having two SPF records — one from an old setup, one from the new — which invalidates both. There must be exactly one, listing everything that sends on your behalf: your mailbox provider, and anything else that emails your customers, such as a booking system, an invoicing tool or your website's contact form.
DKIM
A cryptographic signature on every message, so a receiving server can confirm it genuinely came from you and was not altered. Your provider generates the keys and gives you the DNS records. Turn it on; it is a setting and a paste.
DMARC
Tells receiving servers what to do with mail that fails the other two, and — the useful part — where to send reports. Start at p=none, which changes nothing and just collects reports, so you can see everything sending as your domain before you tighten. Once the reports are clean, move to quarantine and then reject. Going straight to reject is how a business stops its own invoices arriving.
If that sounds like more than you want to do, it is a one-hour job for whoever manages your DNS and it is worth paying for. The alternative is quotes that silently do not arrive.
Which addresses to create
Fewer than you think, and name them for roles rather than people where you can.
- One personal address per human — firstname@ is friendlier than initials and easier to say on the phone.
- hello@ or enquiries@ as the public one. Put this on the website, not a personal address, so it survives somebody leaving.
- accounts@ or invoices@ if you raise them. Keeps the money thread out of a personal inbox and lets somebody cover it.
- An alias, not a mailbox, wherever possible. Most providers let several addresses deliver into one inbox at no extra cost — a sole trader does not need to pay for four mailboxes.
Two things to avoid. Do not create info@ out of habit if nobody will read it — an address nobody checks is worse than no address. And do not publish a personal address as the main contact route: when that person goes, the enquiries go with them.
On your website, remember that a published address is harvested by spam bots. A contact form plus a role address is the usual compromise, and the form should be the one you actually monitor.
Make sure you own it, not your web person
This matters more than anything above and it is almost always arranged wrongly.
Three things need to be in your name, on your card, in an account you can log into: the domain registration, the DNS, and the mailbox subscription. If your web designer holds any of the three, you cannot change supplier without their cooperation.
That is not a prediction of bad behaviour. Most of the time it is simply someone who set it up on their own account to be helpful six years ago and has since stopped replying to email, and the business cannot prove ownership of its own domain.
If you are not sure, check now: log into your registrar and look at the registrant, then check whose card the mailbox subscription bills to. Give yourself the owner or super-admin role even if somebody else does the day-to-day. There is a separate guide on this site about who owns your website, and the email is the half people forget.
The whole job, in order
- Confirm you own the domain and can log into the registrar yourself.
- Pick a mailbox provider and sign up with your own payment details.
- Add the MX records they give you. Mail starts flowing to the new mailbox.
- Add exactly one SPF record, covering everything that sends as you.
- Turn on DKIM and add the records.
- Add DMARC at p=none and read the reports for a fortnight.
- Create role addresses and aliases rather than extra paid mailboxes.
- Move anything that sends on your behalf — forms, invoicing, booking — into SPF.
- Tighten DMARC to quarantine, then reject, once reports are clean.
- Send a test to a Gmail and an Outlook address and check the headers show SPF and DKIM passing.
Step ten takes two minutes and is the only way to know the first nine worked.
