Skip to content
Knowledge Hub/Article
Article

What Is Business Email? Management and Security

Business email runs on your organization's own domain, with accounts it controls. We cover the platforms, account management, SPF, DKIM and DMARC.

Oğuzhan Gerçek··9 min read
What Is Business Email? Management and Security

Short answer: Business email is email that uses the organization's own domain name (name@yourcompany.com) and whose accounts the organization manages. What sets it apart from a free address is ownership: accounts and correspondence belong to the organization, a mailbox stays with the company when an employee leaves, and security and retention rules are applied centrally. It can be bought as a cloud service through Microsoft 365 or Google Workspace, or run in-house on Exchange Server. Its security rests on SPF, DKIM and DMARC records and on multifactor authentication (MFA).

What is business email?

With business email, the domain in the address belongs to the organization. The MX record in that domain's DNS decides which server accepts its mail; as Cloudflare puts it, the MX record indicates how email should be routed in accordance with SMTP. When you change platforms, the addresses stay the same; only the server the MX record points to changes.

Microsoft recommends that organizations use their own domain: a custom domain improves brand recognition, email deliverability and user trust. In Google Workspace, a domain is required. We explain why a domain should be tracked like any other corporate asset in our glossary.

How is it different from free email?

The difference is not the address but ownership. In Google's comparison, @gmail.com accounts are user owned and administered by a single user only, while domain-verified accounts are organization owned and admins manage all user data. In practice, this means:

  • When an employee leaves, their correspondence stays with the organization.
  • Password, MFA, sharing and retention rules apply to every account from one place.
  • The records that make spoofing harder are published on the organization's own domain.

Running that central layer is what we call email management.

Microsoft 365, Google Workspace and Exchange Server

  • Microsoft 365 (Exchange Online): According to Microsoft's limits table, mailboxes on the Business and E3/E5 plans hold 100 GB; on Business Premium and E3/E5, auto-expanding archiving lets the archive grow to 1.5 TB.
  • Google Workspace: Storage is shared across Gmail and Drive; according to the pricing page, pooled storage per user is 30 GB on Business Starter, 2 TB on Business Standard and 5 TB on Business Plus.
  • Exchange Server (on-premises): According to Microsoft, support for Exchange Server 2016 and 2019 ended on October 14, 2025; these versions no longer receive technical support, bug fixes or security fixes. The way to stay on-premises is Exchange Server Subscription Edition (SE), released on July 1, 2025 and governed by the Modern Lifecycle Policy.

There is also the hosted Exchange model, in which a provider runs the server for you. We explain which responsibilities stay with you in the cloud in our SaaS article.

Business email management: accounts, archiving and migration

Account lifecycle. When someone joins, an account is created, a license assigned and MFA registered; when they leave, sign-in is blocked first. Per Microsoft's guidance, a former employee's email can be forwarded to whoever takes over, or the mailbox converted to a shared mailbox; if the license is removed, the email is permanently deleted after 30 days. In Google Workspace, a user's email can be transferred to another account or exported with Vault before the user is deleted; content that isn't transferred is deleted.

Archiving and retention. In Microsoft 365, a mailbox that had a retention policy or hold applied before the account was deleted becomes an inactive mailbox, and its content is preserved. On the Google side, Vault does this job: it retains, holds, searches and exports data. Vault is included in the Business Plus and Enterprise editions, and some other editions can add it as a separate license.

Migration. According to Microsoft's migration guide, a cutover migration can move up to 2,000 mailboxes, but because of the time involved, 150 or fewer is more reasonable; for Exchange 2013 and later, hybrid migration is the recommended route. IMAP migration moves only email, leaving contacts and calendars behind. The last step is pointing the MX record at the new platform: Microsoft recommends lowering its TTL to 3,600 seconds or less before migrating, and notes that the change can take up to 72 hours to reach other organizations' systems.

SPF, DKIM and DMARC: protecting your domain from spoofing

The abstract of the SPF standard opens with a plain statement: email on the internet can be forged in a number of ways. Three DNS records narrow that gap:

  • SPF (RFC 7208): A TXT record listing the servers authorized to send mail for your domain. If more than 10 terms that cause DNS queries (include, a, mx, ptr, exists, redirect) are evaluated, the result is an error (permerror); records that include many third-party services run into this limit.
  • DKIM (RFC 6376): Adds a cryptographic signature to outgoing mail; the receiver reads the public key from a selector record under "_domainkey" in the sending domain's DNS. In Microsoft 365, mail from your custom domain isn't DKIM-signed with that domain until you set it up.
  • DMARC: Publishes the domain owner's preference for mail that fails validation: none (no preference), quarantine (treat as suspicious) or reject. To pass, the domain authenticated by SPF or DKIM must be aligned with the domain in the From address the reader sees.

DMARC's first specification, the 2015 RFC 7489, was an Informational document. RFC 9989, published on the IETF Standards Track (Proposed Standard) in May 2026, replaced it, and reporting is now defined in RFC 9990 and RFC 9991. Microsoft recommends a gradual rollout: start with p=none, use the daily aggregate reports to find legitimate mail that fails, then move to quarantine and finally to reject.

Bulk sender rules: Gmail, Yahoo and Outlook.com

Under Gmail's rules, in force since February 2024, anyone sending close to 5,000 messages or more to personal Gmail accounts within 24 hours counts as a bulk sender; messages from the same primary domain count together, and the status is permanent. Bulk senders need:

  • Both SPF and DKIM, a DMARC record with at least p=none, and alignment with the From domain
  • One-click unsubscribe for marketing messages, with requests honored within 48 hours
  • A spam rate below 0.3% (Google recommends staying under 0.1%)

Since November 2025, Google has been ramping up enforcement on non-compliant traffic. Yahoo has applied similar requirements since February 2024. Outlook.com also expects SPF, DKIM and DMARC from anyone sending 5,000 or more messages from the same From domain to its consumer addresses, and rejects mail that falls short with error 550 5.7.515. Microsoft states that Exchange Online isn't suited to bulk mailing and points bulk commercial email such as newsletters to providers that specialize in it. Sending through such services from a subdomain (for example, news.yourcompany.com) rather than your main domain is one of the recommendations in Microsoft's DMARC guidance.

Phishing, account takeover and MFA

According to ENISA's September 2026 report, phishing made up 77.8% of the social engineering techniques used in incidents targeting the EU in 2025, and malicious spam (malspam) 13%; most phishing was carried out by email. DMARC makes exact spoofing of your domain harder, but it does not stop mail from a lookalike domain or from a genuine account that has been compromised.

According to Microsoft, most compromising sign-in attempts come from legacy authentication, which doesn't support MFA. Basic authentication has been turned off in Exchange Online for protocols such as POP, IMAP and ActiveSync. The type of MFA matters too: according to CISA, the US cybersecurity agency, the only widely available phishing-resistant authentication is FIDO/WebAuthn; a one-time code typed into a fake sign-in page reaches the attacker as well. We cover phishing in our cybersecurity article, and MFA and single sign-on in our identity management service.

Is KEP the same as business email?

No. KEP (kayıtlı elektronik posta, registered electronic mail) is defined by the BTK, Türkiye's ICT regulator, as email that is legally valid and technically secure: it provides evidence of whether a message came from the apparent sender, whether and when it reached the recipient, and whether it was read. KEP is a closed system and cannot exchange messages with standard email addresses. Accounts are obtained from KEP service providers.

Frequently asked questions

What is a business email address? An address that ends in the organization's own domain name, on an account the organization manages. It is also called corporate email.

How do you set up business email? You need a domain first. Then you choose a platform, verify ownership of the domain with a TXT record in DNS, point the MX record at the new platform and publish SPF, DKIM and DMARC records.

What is email management? Running an organization's mail: opening and closing accounts, mail flow security, quotas, archiving, retention and migration.

Are SPF, DKIM and DMARC mandatory? Gmail and Yahoo require at least SPF or DKIM from all senders, and all three from bulk senders. Mail that doesn't meet the requirements can be rejected.

Can you keep using Exchange Server 2019? The server keeps running, but since October 14, 2025 Microsoft has provided no technical support, bug fixes or security fixes for it. Microsoft's recommended paths are upgrading to Exchange Server SE or moving to Microsoft 365.

Sources