Understand the parts
The domain is the address the business owns, such as example.co.uk. The email provider hosts the mailboxes. DNS records tell other systems where mail should go and how messages from the domain can be authenticated. These may be managed by different companies, so document every account.
Choose addresses around roles
Give each person a named account and use role addresses such as accounts@, bookings@ or hello@ where several people may need continuity. A role address can be a shared mailbox, group or alias depending on the required behaviour. Avoid one shared password used by the whole team.
Keep the domain under business control
- Register the domain in the legal owner's name with current business contact details.
- Use MFA on the registrar and email administrator accounts.
- Record renewal dates, payment methods and authorised administrators.
- Keep emergency recovery separate from a single employee or supplier.
Configure mail flow carefully
Create the receiving mailboxes before changing the MX record. Add the provider's required verification and service records exactly as documented. Preserve a record of the previous DNS values and allow for propagation rather than making repeated unplanned changes.
Authenticate messages from the domain
SPF identifies authorised sending systems, DKIM adds a cryptographic signature and DMARC publishes how receivers should handle and report authentication results. Inventory every legitimate sender—mailboxes, website forms, invoicing, CRM and newsletters—before tightening policy.
Microsoft's current guidance recommends configuring SPF, DKIM and DMARC for custom Microsoft 365 domains. Other providers publish their own required records.
Plan the transition from a consumer address
- Create and secure the new account.
- Update the website, invoices, directory listings and customer templates.
- Tell important contacts about the change.
- Keep the old address monitored for a defined transition period.
- Do not automatically forward sensitive mail without reviewing the security and data implications.
Backups and offboarding still matter
Cloud email provides availability, but deletion, compromised accounts and retention limits still require consideration. Decide what must be retained or backed up and how a departing person's mailbox and business records will be handled.
Official guidance
Microsoft documents how to add a custom domain and configure the required records. Its email and collaboration security guidance covers authentication for Microsoft 365 domains.
Need help applying this to your business?
Vengera can assess the current setup, explain the priorities and scope any practical improvements.