How to get business email: Domain email setup and MX, SPF, DKIM, DMARC settings (2026)

MX record: Where incoming email is delivered

The MX record tells which server should receive email addressed to a domain; the sending server queries this record on the recipient’s domain before delivery. Google Workspace’s page on setting up MX records states that the value is smtp.google.com and that 1 is entered in the priority field. Accounts set up before 2023 may show older values beginning with “aspmx”; if email works without problems, these do not need to be changed.

The same page says to delete other MX records in the zone when adding the new value and notes that recognition of the change can take up to 72 hours. In Microsoft 365, the previous provider’s MX record is either removed or assigned a lower priority than Microsoft’s record; a smaller number means a higher priority in MX records. Some DNS panels require a period at the end of the value, while others provide a ready-made option.

SPF record: Who may send email on behalf of the domain

SPF is a TXT record added to the domain’s DNS that lists servers authorized to send email on behalf of that domain. The recipient server checks whether the server delivering the message is on this list. For a domain using only Google Workspace, Google’s recommended record is v=spf1 include:_spf.google.com ~all. Microsoft Learn’s page on configuring SPF provides v=spf1 include:spf.protection.outlook.com -all as an example for domains using only Microsoft 365.

At the end of the record, ~all requests that email from unlisted servers be flagged, while -all requests rejection; the recipient system decides what actually happens to the message. The same Microsoft page states that only one SPF record is allowed per domain and subdomain and that authentication will fail if the check requires too many DNS queries. On Google’s side, an SPF record can contain at most 10 include tags, and the record may take up to 48 hours to become active.

SPF must include not just the email provider but every service that sends messages on behalf of the domain. Google’s list also includes web servers, services that send automatically such as “Contact us” forms, and newsletter tools. If contact form notifications from a WordPress website are sent from the website’s server, that server must also be defined in SPF; otherwise, form emails may land in spam.

DKIM and DMARC: The signature and policy layer

DKIM adds a signature to every outgoing message using a private key; the recipient server verifies this signature with the public key published in DNS. In Google Workspace, the key is generated under “Authenticate email” in the Gmail settings of the Admin console; the default selector is “google,” and a length of 2048 bits is recommended if supported by the DNS provider. After Gmail is activated, a wait of 24 to 72 hours may be necessary before the key can be obtained. In Microsoft 365, DKIM works through two CNAME records named selector1 and selector2.

DMARC is a TXT record added under the name _dmarc that tells the recipient server what to do with messages that fail SPF or DKIM checks. The policy takes three values: none delivers the message and only records it in a report, quarantine sends it to spam, and reject rejects it. Google’s page on setting up DMARC recommends waiting 48 hours after setting up SPF and DKIM, starting with none, and moving to quarantine or reject as reports are reviewed.

Because many DMARC reports can arrive each day, Google recommends creating a separate group or dedicated mailbox for them. The reports help identify sends that fail authentication and sources impersonating the domain. Before tightening the policy, SPF and DKIM settings are completed for legitimate services appearing in those reports.

How do Gmail’s 2024 sender requirements affect business addresses?

Google’s email sender guidelines set minimum requirements for everyone sending messages to personal Gmail accounts from February 1, 2024. These requirements include SPF or DKIM on the sending domain, defined forward and reverse DNS (PTR) records for the sending server, a TLS connection, and a spam rate below 0.3% as reflected in Postmaster Tools. Senders sending 5,000 or more messages to Gmail each day are additionally required to have a DMARC record (a none policy is sufficient), alignment of the “From” address with the SPF or DKIM domain, and one-click unsubscribe in marketing messages.

A small business handling everyday correspondence will not approach the 5,000 threshold, but the first group of requirements applies to everyone. According to the guidelines, unauthenticated messages may be marked as spam or rejected with error code 5.7.26. Because every customer-facing email, such as a quotation, invoice, or appointment reminder, is affected by these rules, SPF and DKIM are prerequisites for delivery rather than optional improvements.

Common mistakes in business email setup

Most complaints heard after setup, such as “email is not arriving” or “sent messages go to spam,” result from a few recurring mistakes:

• Leaving the old MX record: If the new provider’s record is added without deleting the old one, incoming email may be split between two servers. Google warns that an address may not work properly with old or incorrect MX records.
• Creating a second SPF record: Adding a separate v=spf1 line for a new service breaks SPF checking. The SPF standard RFC 7208 prohibits multiple SPF records on a domain; Microsoft also asks that the new value be added to the existing record and combined into one line.
• Uncontrolled catch-all: The default address in cPanel collects email sent to nonexistent addresses on the domain. cPanel documentation states that this address may receive many unwanted messages when the domain is targeted by spam.
• A mailbox shared with a single password: When several people use the password for a shared address such as info@, changing the password when an employee leaves and tracking who sent what become difficult. For shared addresses, the provider’s group, alias, or shared mailbox feature is preferred.
• Not monitoring the quota: According to Microsoft’s Exchange Online limits, when a mailbox is full, incoming email is rejected and the sender receives a nondelivery notification.
• Starting DMARC with reject: Choosing a strict policy before all sending sources are authenticated may also cause legitimate email to be rejected.

Account ownership is also a hidden setup mistake. If the administrator account remains linked to the personal address of the person performing setup, billing, password resets, and DNS changes later become dependent on that person. In setups carried out by Onur Freelance, the domain and hosting account are registered in the business’s own name; the same principle applies to the email provider’s administrator account.

Migrating existing email and changing providers

Changing providers is more than switching the MX record. Microsoft Learn’s DNS records guide states that new email goes to Microsoft 365 from the moment MX is updated, while older messages remain with the previous provider unless migrated. Google Workspace’s data import tool can also transfer email from IMAP-enabled services, Exchange Online, and another Workspace or Gmail account.

According to Microsoft’s IMAP migration documentation, this method transfers only email folders; contacts, calendars, and tasks are not migrated. Up to 500,000 items per user can be transferred, with messages no larger than 35 MB. The old hosting package is not closed until migration is finished and mailboxes have been checked; the MX change is also scheduled for hours with the lowest email traffic.

When choosing a provider, where data is processed should also be asked. Article 9 of KVKK (Turkey’s Personal Data Protection Law), Law No. 6698, amended on March 2, 2024, makes transfers of personal data abroad subject to conditions such as an adequacy decision or appropriate safeguards specified in the law. Since customer and employee correspondence contains personal data, it is appropriate to make this assessment with legal counsel.

If a website redesign or hosting migration is planned, the email migration is tied to the same schedule. Corporate web design projects (starting at 15,000 TL) address domain, hosting, and email decisions together in the first meeting. Regular monitoring after launch can be discussed within the maintenance service; monthly maintenance costs remain between 500 and 2,000 TL depending on scope, and the details are explained on the website management page.