Custom domain email for small business: the complete setup guide

Running a business from a Gmail address costs you credibility on every quote you send, and it means your business identity belongs to someone else. Moving to your own domain takes about twenty minutes of DNS work.

Why it's worth doing

• Credibility. accounts@yourbusiness.com.au reads as an established business; yourbusiness2019@gmail.com reads as a side project.
• You own the identity. Staff change, providers change. If the address is on your domain, the mailbox moves with you and the address survives.
• Continuity. When someone leaves, you keep their mailbox and their client history. With a personal free-mail account, you don't.
• Deliverability control. SPF, DKIM and DMARC on your own domain make your mail verifiably yours.

Step 1: Register a domain (if you haven't)

Pick something short and speakable — you'll read it aloud constantly. For an Australian business, .com.au signals local presence and requires an ABN or ACN, which is itself a small trust signal. Buy the .com too if it's available and affordable; it's cheap insurance against someone else using your name.

Step 2: Add the domain to Tobava Mail

Custom domains are part of the paid plans. The ownership check — a TXT record you add at your DNS provider, then verify — is part of signing up with your own domain. Once you're set up, your domain's records live under Settings → Domains, which is where you'll find the MX, SPF, DKIM and DMARC values to publish.

Step 3: Point your MX records

MX records tell the rest of the world where your mail goes. At your DNS provider, remove any existing MX records for the domain and add the ones shown in your Tobava Mail domain settings.

Step 4: Publish SPF, DKIM and DMARC

Three TXT records, all of which matter for landing in inboxes rather than spam folders:

• SPF — lists who may send as your domain. One SPF record only; merge includes if you also send from a CRM or invoicing tool.
• DKIM — publishes the public key that signs your outbound mail. Copy the record and its selector exactly as shown in your domain settings.
• DMARC — tells receivers what to do when the first two fail. Start at p=none, review the reports, then tighten to quarantine and eventually reject.

A common and costly mistake: setting p=reject before DKIM is correctly published. Then your own legitimate mail gets rejected. Start permissive and tighten. Full detail in our SPF, DKIM and DMARC explainer.

Step 5: Plan your addresses before creating them

A small structure now saves a mess later:

• Personal mailboxes — firstname@ for each person.
• Role addresses get their own account — accounts@, info@, support@. These must outlive staff changes. Tobava Mail doesn't offer shared-mailbox delegation today, so give each role address its own account rather than making it an alias on someone's personal mailbox — that way the history stays with the role when people move on.
• Aliases for variations of one person's address — an alias delivers into its owner's mailbox, so it's the right tool for firstname.lastname@ alongside firstname@, not for sharing a role between people. Alias allowances depend on your plan.
• No catch-all. Tobava Mail delivers only to addresses that exist, which is deliberate — catch-alls collect enormous spam volume. Create explicit addresses and aliases instead.

Step 6: Set up mail on everyone's devices

Tobava Mail works in any browser and in any standard mail client over IMAP/SMTP. For Outlook, Apple Mail or Thunderbird, the server names and ports are shown in Settings alongside your forwarding options, and you'll generate an app password to sign the client in rather than using your normal password.

Step 7: Turn on MFA before you hand out logins

A business mailbox is the reset mechanism for every other account the business owns. Require two-step verification from day one — an authenticator app, with an emailed fallback code — rather than retrofitting it after an incident.

Step 8: Verify it actually works

Send a message to a Gmail address, open Show original, and confirm spf=pass, dkim=pass and dmarc=pass. If DKIM says fail, the published key almost certainly doesn't match what's signing — re-copy the record without leading or trailing characters, which is the single most common cause.