Many people think of a domain as a website address, but for a lot of small businesses its most important job is email. A message from you@yourdomain says you are a real business with a stable presence. A message from a free webmail address with your trading name and a number on the end says something else.
The website can be down for a day without much damage. Mail cannot. Invoices, quotes, supplier replies and password resets all arrive by email, and they arrive at the address your domain provides.
That makes the domain's reliability critical. Lost domain means lost mail, including password reset messages for every service tied to that address. Keep the domain safe, use a mail provider with a good reputation, publish authentication records, and make sure more than one person can recover access to the registrar account.
What the domain does for mail
When someone writes to [email protected], their mail server asks DNS where mail for example.com goes. The answer is the MX record. Your host or mail provider gives you the values, and you publish them at your DNS host.
example.com. 3600 IN MX 10 mail.example.com.
example.com. 3600 IN MX 20 backup.example.com.The lower number is tried first. If the DNS records disappear, for instance because the domain expired and the registrar parked it, new mail has nowhere to go. Senders see bounces after a while, or worse, the messages are accepted by whoever now answers for the name.
Authentication: the three records
To prove that mail from your domain is really yours, publish three kinds of record. SPF lists the servers allowed to send for you. DKIM adds a signature that the receiver checks against a public key in your DNS. DMARC tells receivers what to do when the first two fail and where to send reports.
example.com. TXT "v=spf1 include:_spf.mailhost.example -all"
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"This is no longer optional in practice. Large mailbox providers now require authentication, and stricter handling for bulk senders, and unauthenticated mail is increasingly sent to spam or rejected. The SPF builder and DMARC builder produce a valid record to start from. Begin DMARC at p=none while you read the reports, then tighten it.
The recovery trap
The most common unforced error is the circular dependency. The registrar account's login email is an address on the very domain the account controls. If the domain lapses, the reset message goes into a mailbox that no longer exists, and you cannot log in to renew it.
Reputation belongs to the domain
Mailbox providers keep a running opinion of every sending domain. It is built from complaint rates, bounces, how often people open your mail and how your authentication checks come out. A new domain starts with no reputation, which is why a brand-new address that sends a hundred invoices on day one sometimes lands in spam. Warm it up: send ordinary mail to real people, keep lists clean, and avoid sudden bursts.
The reputation is attached to the domain rather than the mailbox host, so moving provider does not wipe it, and a lapse and re-registration by someone else does not inherit it either. Another good reason never to let it go.
Mail forwarding from a personal address into a mailbox on your domain also deserves care, because forwarding can break SPF. Where you can, deliver straight to the mailbox instead.
Keeping the domain safe
- Turn on auto-renew, and keep a valid payment card on file with a date after the card expiry that you diarise.
- Enable two-factor authentication on the registrar account, with recovery codes stored somewhere that is not your email.
- Give at least two trusted people access, or document how the owner's account can be recovered.
- Send renewal notices to a role mailbox on a different domain.
- Lock the domain against transfers unless you are moving it.
Quick answers
Can I change my mail provider later?
Yes. Lower the TTL, change the MX, SPF and DKIM records together, and migrate the old mailboxes. The TTL planner helps with timing.
Is one address for everything fine?
For a start. Use separate role addresses such as billing and support once more people are involved.
What if my domain expires?
Mail stops at once. The timeline is in the expiry piece in this series; renew first and sort the rest out afterwards.