Business Mailboxes for Clients

Clients usually want name@theirbusiness.com mailboxes, not just app email.

Choosing a mailbox provider

Setup steps

1. Create the provider account in the client's name and verify the domain (a TXT record).
2. Add MX records; remove old ones.
3. Publish SPF including the provider, enable DKIM in the admin console and publish its record, then add DMARC (p=none first).
4. Create users, aliases (info@, sales@) and shared inboxes or groups.
5. Migrate old mail with the provider's import tools if needed.

Security for mailboxes

• Enforce two-factor authentication for every user.
• Disable legacy protocols that bypass 2FA where possible.
• Train staff to recognise phishing; email is the most common entry point for attacks on small businesses.
• Move DMARC to p=quarantine or p=reject once all senders pass, so scammers cannot spoof the business.

Forwarding and aliases

Simple forwarding (for example via Cloudflare Email Routing or your registrar) is fine for receiving, but replies come from the personal address. For a professional setup, use real mailboxes or "send as" aliases.

Handover

Give the client admin access, document licences and renewal dates, and keep yourself as a secondary admin only if agreed.

Exercise

Write a step-by-step setup and handover guide for giving a five-person business professional email with shared info@ and sales@ addresses, 2FA, and SPF/DKIM/DMARC.

Check yourself

• Why verify the domain before adding MX records?
• Why enforce 2FA on every mailbox?
• When is simple forwarding not enough?