Creating [email protected] requires more than adding text to a control panel. The safe process establishes domain control, an accountable mailbox, correct DNS, sender authentication, recovery and a tested route for website messages.
Before you make a change
An incorrect MX or nameserver change can stop incoming mail. Export the current DNS zone and prepare a rollback before replacing production records.
Choose the address structure
- Use named individual accounts for staff.
- Use role aliases or groups for sales@, accounts@ or support@.
- Avoid using one shared password for several people.
- Keep an independent recovery route for the domain and email administrator.
- Decide who owns archived mail when an employee leaves.
Set up the service
- Choose an email provider that supports the required administration, security and retention.
- Verify the domain using the provider’s current method.
- Create administrator accounts and enable MFA.
- Create users, aliases and groups.
- Add the provider’s MX records without deleting unrelated DNS records.
- Configure SPF and DKIM for legitimate senders.
- Start DMARC with monitoring, then strengthen the policy after all senders are accounted for.
- Configure devices using supported modern authentication.
Test the complete route
| Test | Expected result |
|---|---|
| Inbound mail | Arrives from several external providers |
| Outbound mail | Reaches recipients without authentication failures |
| Reply and display name | Uses the intended business identity |
| Website form | Delivers through an authenticated service and records failure |
| Recovery | Administrator can recover a user securely |
| Authentication | Headers show expected SPF, DKIM and DMARC results |
Avoid common shortcuts
- Do not forward all business mail to a free personal inbox without considering security and delivery.
- Do not publish two separate SPF records at the same hostname.
- Do not use the web-hosting server as the default sender merely because PHP mail is available.
- Do not set DMARC to reject before every legitimate sender has been tested.
Document ownership
Record the provider, administrator, billing owner, recovery process, mailbox list and DNS records. The business should be able to continue email if the website developer disappears.
Website forms need separate attention
A contact form should not impersonate the visitor by placing the visitor’s address in the From field. Send from an authenticated address on the business domain and place the visitor’s address in Reply-To. This improves alignment and makes delivery failures easier to diagnose.
Store a submission or reference in the website or CRM where appropriate, show the visitor a clear success or failure message, and test the route after DNS, hosting or plugin changes. Email delivery alone should not be the only evidence that an important enquiry existed.
Final publication check
- MX changes preserve unrelated DNS records.
- Staff accounts, aliases and groups match real responsibilities.
- Outbound mail and website forms authenticate correctly.
- The business can recover users without the website developer.
Sources and date checked
Technical and policy information was checked on 21 July 2026. Recheck provider-specific procedures before making a live change.
Keep the decision under your control
Retain the relevant accounts, source material, supplier terms and recovery information. Recheck changing prices, interfaces and rules before acting.