The sales manager of a textile company in Riyadh left after five years, and his address nassij.riyadh.sales@gmail.com left with him: his correspondence with suppliers, the price quotes, the customer contacts, and the company’s Facebook account, which he’d created with that same address. Nobody hacked anything; the account was simply his. That’s the first argument for email on your company’s domain, and it’s about ownership before it’s about image: whoever owns the domain owns the addresses, and whoever owns the addresses owns the correspondence and every service that resets its password through them.
01Who owns the account?
With free webmail, the employee opens the account in their own name and with their own phone number, and accepts the terms of service as a private person. The company isn’t a party to that contract, so it can’t claim the account when it needs it. On your own domain the company owns the accounts, and its email administrator has three powers no one has over free webmail:
- Immediate shutdown: When an employee leaves, you disable their sign-in within a minute, so they’re left with nothing to send from in the company’s name.
- Continuity: You hand their mailbox to a colleague, or turn their address into an that routes new mail to whoever takes over their work, so customers never lose their way to you.
- Retention: Their correspondence stays with the company under the retention policy you choose, so you can go back to it in a supplier dispute or a financial audit.
And the chain doesn’t stop at email. Every account the company created with an employee’s address, from the hosting panel to the payment gateway and social media pages, resets its password through that address. So register these services with role addresses such as admin@ or accounts@, never a person’s address. The domain itself becomes an asset to protect: turn on the transfer lock and auto-renewal, because an expired domain means stopped email.
02Trust: can the recipient verify you?
Anyone can create a free address that looks like yours in two minutes, say nassij.riyadh.sales1@gmail.com, and the recipient can only tell the real one from the fake by instinct. A message from sales@nassij-riyadh.com, on the other hand, is checked automatically by the receiving server, because only you publish your domain’s records: SPF lists the servers allowed to send, DKIM signs every message, and tells the world’s mail servers what to do with a message that claims to be from you and fails the check.
This shows up in whether your mail arrives. In business-to-business dealings, many procurement teams and supplier-registration systems won’t accept a free address for a vendor, and filters look harder at invoices and payment requests that come from free addresses. Newsletter platforms ask you for a sender on a domain you own, because the free provider’s DMARC policy doesn’t authorise their servers. And since February 2024 Gmail and Yahoo have required anyone sending about 5,000 messages a day or more to authenticate their domain with SPF, DKIM and DMARC, which is impossible on a domain you don’t own.
03Security: what actually changes?
Be fair to free webmail: the big providers encrypt connections with TLS, filter spam and phishing very well, and offer . The difference isn’t the quality of the filters; it’s who sets the rules. On free webmail each employee decides alone whether to turn on a second factor, where to forward their mail, and which devices to open it on. On your domain the company sets the same rule for everyone and checks that it’s followed.
The biggest threat to small businesses today isn’t a virus; it’s : a message that seems to come from your manager or a supplier you know, asking for a payment to go to a new bank account. On your domain two layers protect you: DMARC at p=reject stops anyone spoofing your own domain, and an internal rule says a change of payment details is never accepted by email alone, only after a call to a number you already know. The second layer is always needed, because DMARC can’t stop a look-alike address on another domain.
You can find out right now whether your company’s domain is protected against spoofing:
# DMARC policy: look for p=reject or p=quarantinedig +short TXT _dmarc.nassij-riyadh.com# SPF record: there must be exactly one, starting with v=spf1dig +short TXT nassij-riyadh.com | grep spf1# The servers that receive your domain’s maildig +short MX nassij-riyadh.com
04Shared mailboxes and aliases
Email on your domain separates the address from the person. The address a customer prints on their invoice stays fixed, while who reads it changes with your needs. An alias delivers mail to one or more employees’ mailboxes, and a brings a team onto a single record where everyone sees what arrived and what was answered:
| Address | Type | Why |
|---|---|---|
| sales@nassij-riyadh.com | Alias delivering to the sales team | Doesn’t change when the team does |
| invoices@nassij-riyadh.com | Shared mailbox for accounts | No invoice gets lost in a personal inbox |
| info@nassij-riyadh.com | Alias delivering to reception | The address printed on the sign and the website |
| admin@nassij-riyadh.com | Technical mailbox owned by management | Used to register hosting panels and payment gateways |
| dmarc@nassij-riyadh.com | Technical mailbox | Receives the daily DMARC reports |
Retention is the company’s decision, not the employee’s: how many years to keep contract and invoice correspondence, and who may delete it. Set the period by what your accounting and legal obligations require. And remember that syncing email to a phone and a laptop isn’t a backup: a message deleted on the server is deleted on every device that syncs with it. We explain the difference between sync and backup in a separate article on the blog.
05Side by side
| Criterion | An address on a free webmail service | Professional email on your domain |
|---|---|---|
| Address | Your name on the provider’s domain | sales@nassij-riyadh.com on your domain |
| Account ownership | The employee who created it | The company |
| When someone leaves | The account and its mail leave with them | Disable sign-in and move the mail in minutes |
| Sender verification | You can’t publish SPF and DKIM for the provider’s domain | You publish SPF, DKIM and DMARC |
| Impersonation | Anyone can create a look-alike address | DMARC at reject turns the impostor away |
| Multi-factor authentication | Available; each employee decides alone | A rule the company sets for everyone |
| Role addresses | One account per address, with a password passed around | Aliases and shared mailboxes |
| Retention and archiving | Up to the account holder | A policy the company sets |
| Cost | No fee, and no one accountable to you | A monthly fee per mailbox, and support you can ask |
06The cost of doing nothing
A mailbox fee is a small number you see on every invoice. The cost of staying on free webmail only shows up all at once:
- An employee leaves: Years of correspondence with customers and suppliers, plus every service registered under their address.
- A forged invoice: One transfer to a fraudster’s account can equal years of the company’s entire email bill.
- A deal that never starts: A supplier-registration system rejects your address, or a quote lands in the customer’s spam folder.
- A late move: The bigger the company grows, the harder it is to change addresses: cards, stamps, signs, registered accounts, and customers used to the old address.
By contrast, email on your domain takes one decision and a few hours of setup: a registered domain, an email service, and correct DNS records.
07Where to start
Start small, and start right from day one:
- 01Register a short, clear domain in your company’s name, and turn on auto-renewal.
- 02Choose where your email lives. If your website is on Illevante’s cPanel hosting, it includes mail accounts on your domain, aliases, SPF and DKIM, and webmail. If you want email independent of your website’s server, business email from Illevante in partnership with Acrux Mail is coming soon.
- 03Publish SPF, DKIM and DMARC at p=none, and read the reports for a few weeks before tightening the policy to reject.
- 04Create role addresses as aliases or shared mailboxes, and register company services with admin@, never a person’s address.
- 05Write the leaver procedure on one page: disable sign-in, hand over the mailbox, and change the passwords of shared services.
We cover the practical setup, from DNS records to configuring mail apps and moving messages from your old provider, in a separate article on the blog.
