# How to Choose a Business Email Service: An 8-Point Checklist for Security, Permissions and Cost

> Choose a business email service on security, not mailbox size: an 8-point checklist for SPF/DKIM/DMARC, shared mailbox rights, approvals and total cost.

Source: https://digitalbridge.com.tr/en/blog/business-email-how-to-choose.html
Publisher: Digital Bridge Teknoloji (https://digitalbridge.com.tr)
Topic: Business Email & Documents
Published: 2026-09-24 · Updated: 2026-10-23

A business email service is email that runs on your company's own domain (name@yourcompany.com), with accounts controlled by the organisation. Choose one not on mailbox size but on whether it protects your domain with SPF, DKIM and DMARC, flags impersonation with a stated reason, gives individual permissions on shared mailboxes and closes a leaver's access in one step.

## Key takeaways

- Choose business email on authentication, inbound analysis, shared mailbox permissions and access management, not on mailbox size.
- According to the FBI IC3 2025 report, reported business email compromise (BEC) losses in the US reached $3.05 billion.
- Since 1 February 2024, Google has required SPF, DKIM and DMARC from anyone sending more than 5,000 messages a day to Gmail.
- Score proposals against eight criteria as "yes / no / how" and test them on real mail in a two-to-three-week pilot.
- Count migration, support, add-on security products and administrator time alongside the licence in the total cost.

When choosing a business email service, the real question is not "how many gigabytes per mailbox?" but "can this system show who handles mail sent and received in the company's name, and with which permissions?" The eight criteria below let you score every proposal on the same scale.

## Why business email is no longer "just email"

In most companies, email is the main channel for quotes, orders, invoices and payment confirmations. Addresses such as `info@`, `accounts@` and `purchasing@` are read by several people, and suppliers and customers write to them because they trust them. To keep supplier invoices from getting lost in one inbox, we recommend the set-up in [managing invoices in a shared inbox](https://digitalbridge.com.tr/en/blog/accounts-payable-shared-inbox.html). That turns the choice of business email provider from an IT purchase into a decision about **business continuity and financial risk**.

A familiar picture in small and mid-sized firms: an email service that came bundled with a web hosting package years ago, shared passwords everybody knows, a former employee's account still open on their phone, and an `info@` inbox where nobody can say who replied to what. It all "works" until the day it doesn't. We explain how a business account differs from a personal one in [what is business email](https://digitalbridge.com.tr/en/blog/what-is-business-email.html), and the risks of running a company on free accounts in [using Gmail for business email](https://digitalbridge.com.tr/en/blog/using-gmail-for-business-email.html).

The volume is not going down either. According to [Microsoft's 2025 Work Trend Index special report](https://www.microsoft.com/en-us/worklab/work-trend-index/breaking-down-infinite-workday), the average worker receives 117 emails a day and is interrupted every two minutes during focus work by a meeting, email or notification. At that pace, relying on human attention alone to catch a fraudulent message is not realistic.

## What does the wrong business email service cost a company?

The price of weak business email infrastructure is rarely a full mailbox. It is fraud and lost trust.

> According to the FBI's Internet Crime Complaint Center (IC3), 24,768 [business email compromise (BEC)](https://digitalbridge.com.tr/en/glossary.html#bec) complaints in the US reported total losses of $3.05 billion in 2025. ([FBI IC3 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf))

[Phishing](https://digitalbridge.com.tr/en/glossary.html#phishing) is the norm rather than the exception. The [UK government's Cyber Security Breaches Survey 2025/2026](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) found that 43% of businesses experienced a cyber breach or attack in the previous 12 months, with phishing by far the most common type (38% of businesses).

Assuming the filter catches everything is also a mistake. In the [Verizon 2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/T1ae/reports/2026-dbir-data-breach-investigations-report.pdf), 3% of attacks blocked by email security gateways were BEC-style emails trying to get the victim to update a bank account ahead of a wire transfer. Those messages usually carry no malicious link or attachment, which is exactly where traditional filtering is weakest.

Deliverability matters too. Under [Google's email sender guidelines](https://support.google.com/a/answer/81126?hl=en), since 1 February 2024 anyone sending more than 5,000 messages a day to Gmail accounts must set up SPF, DKIM and DMARC, and the rule remains in force as of 2026. Even if your volume is far lower, domains without proper authentication are more likely to land in the recipient's spam folder. If your mail is already going to spam, the diagnosis order is in [why emails go to spam](https://digitalbridge.com.tr/en/blog/emails-going-to-spam-fix.html); once DMARC is live, our guide on [how to read DMARC reports](https://digitalbridge.com.tr/en/blog/how-to-read-dmarc-reports.html) explains what the reports tell you.

## Which eight criteria matter when choosing a business email service?

When comparing business email proposals, score each one against these eight criteria as "yes / no / how". A "yes" is not enough: ask to see it working in a demo.

1. **Domain and authentication management.** Ask who sets up SPF, DKIM and DMARC, who monitors them and whether their status is visible in the admin panel; the details are in our [guide to SPF, DKIM and DMARC](https://digitalbridge.com.tr/en/blog/spf-dkim-dmarc-explained.html). These records make your domain harder to spoof, but they do not stop [lookalike domain attacks](https://digitalbridge.com.tr/en/blog/lookalike-domain-attacks.html) sent from a domain one letter away; that burden falls on inbound analysis.
2. **Inbound analysis.** Is there only a spam score, or are signals such as lookalike domains, display-name impersonation and Reply-To mismatches assessed separately, with a readable reason for each decision? The signs staff should look for are in [how to spot phishing emails](https://digitalbridge.com.tr/en/blog/how-to-spot-phishing-emails.html); the type finance teams meet most often is the [fake invoice email](https://digitalbridge.com.tr/en/blog/fake-invoice-email-scams.html).
3. **Shared mailbox permissions.** Do people reach `info@` or `accounts@` by sharing a password, or through individual, granular permissions? Deletion and other risky actions should be separate rights; we explain the set-up in [shared mailbox management](https://digitalbridge.com.tr/en/blog/shared-mailbox-management.html). If a group of companies needs several domains and shared mailboxes run from one panel, see the permission model in [multi-company email management](https://digitalbridge.com.tr/en/blog/multi-company-email-management.html).
4. **Send approval.** Can messages sent in the company's name — quotes, payment confirmations, formal letters — be routed for approval before they leave? The steps and approvers are illustrated in our [email approval workflow](https://digitalbridge.com.tr/en/blog/email-approval-workflow.html) article. For official notices in Türkiye that must carry legal evidential weight, ordinary email gives way to [registered electronic mail (KEP)](https://digitalbridge.com.tr/en/blog/registered-electronic-mail-kep-turkey.html).
5. **Identity lifecycle.** Are joiners, movers and leavers handled in one place, and can open sessions be ended remotely? The single-identity approach is covered in [single sign-on benefits](https://digitalbridge.com.tr/en/blog/single-sign-on-sso-benefits.html), and handing over a leaver's mailbox in [offboarding email access](https://digitalbridge.com.tr/en/blog/offboarding-email-access.html).
6. **Audit trail.** Is it recorded who opened, moved or replied to each message? For firms that bid for contracts, proving who sent a tender, when and in which version depends on this record; we work through the scenario in [tender email security](https://digitalbridge.com.tr/en/blog/tender-email-security.html). Ask, too, which [business email encryption options](https://digitalbridge.com.tr/en/blog/business-email-encryption.html) keep quotes and contracts unreadable in transit and at rest.
7. **Data location, archive and files.** Find out where data is stored and how it is separated from other customers' data; as the data controller, whether under the GDPR or Türkiye's KVKK, you need to know. For retention periods, see [email archiving compliance](https://digitalbridge.com.tr/en/blog/email-archiving-data-protection.html). Contracts that travel as attachments leave a copy in every mailbox, so ask whether the email service works alongside a [business document management](https://digitalbridge.com.tr/en/blog/business-document-management-guide.html) space that sends permission-controlled links instead.
8. **Total cost of ownership.** Beyond the licence, count setup, migration, support, add-on security products and administrator time. Our article on [cloud migration costs](https://digitalbridge.com.tr/en/blog/cloud-migration-cost.html) is a useful checklist of the items that tend to be missed. If your files still sit on an office server, planning [replacing the on-premise file server](https://digitalbridge.com.tr/en/blog/replacing-on-premise-file-server.html) in the same project can lower the total.

### Business email service comparison table

| Criterion | Hosting-bundled mail | General-purpose large platform | Process-focused business email |
|---|---|---|---|
| SPF/DKIM/DMARC | Often manual, unmonitored | Available, configuration is on you | Managed in the panel, status visible |
| Inbound analysis | Basic spam filter | Advanced, often with add-on licences | Multi-signal, with a written rationale |
| Shared mailbox rights | Shared password | Delegate access, limited granularity | Separate permissions per mailbox |
| Send approval | None | Usually needs an extra tool | Built-in approval workflow |
| Leavers | Manual password change | Central, but per product | One identity across all products |

The table shows general tendencies; test each provider against your own checklist.

## How do you run a business email selection in five steps?

Making the business email decision in five steps, rather than in a single meeting, lowers the risk:

1. **Map the current state.** How many mailboxes and shared addresses are there, who can access which, and what state are your DNS records in?
2. **Identify risky flows.** Which addresses send payments, quotes, contracts and formal correspondence? Those are your approval-workflow candidates.
3. **Pilot it.** Run one department, such as accounts, on the new system for two or three weeks and watch the analysis and permission model on real mail.
4. **Plan the migration.** The MX change, moving old mail and informing users should sit on a single timeline.
5. **Write the operating rules.** Shared mailbox ownership, the message types that need approval, a [corporate email signature standard](https://digitalbridge.com.tr/en/blog/corporate-email-signature-management.html) and the leaver checklist should be written down.

For wider infrastructure decisions, see our [cloud migration and infrastructure consultancy](https://digitalbridge.com.tr/en/consultancy/cloud-migration-infrastructure-consultancy.html); for the personal data side, our [data protection compliance service](https://digitalbridge.com.tr/en/consultancy/data-protection-compliance.html).

We have separate guides for the two jobs that follow the decision: [setting up email with your own domain](https://digitalbridge.com.tr/en/blog/set-up-email-with-your-domain.html) and moving existing mail without loss in our [business email migration guide](https://digitalbridge.com.tr/en/blog/email-migration-guide.html).

Where drawings, contracts or customs paperwork circulate heavily, email and file organisation should be tackled together. For sector examples, see [project file management for architecture and engineering firms](https://digitalbridge.com.tr/en/blog/architecture-engineering-project-file-management.html) and [import export document management](https://digitalbridge.com.tr/en/blog/import-export-document-management.html).

## How does Digital Bridge run business email projects?

Digital Bridge has been based in Adana since 2013 and serves organisations across every province of Türkiye, remotely and on site — including international companies operating here. In business email projects we do not push packaged solutions: we start with a needs analysis, then put scope, phases and cost in a written proposal.

- **Assessment:** We review your domain's SPF, DKIM and DMARC status, the access structure of shared mailboxes and any leftover leaver accounts. This can also run as part of our [cyber security consultancy](https://digitalbridge.com.tr/en/consultancy/cyber-security.html).
- **Design:** Together we decide which addresses become shared mailboxes, who works with which permissions and which messages go through approval.
- **Transition and training:** A migration timeline, user training and close support in the first weeks.
- **Ongoing support:** Office support on weekdays 10:00–18:00 (Türkiye time) and technical support around the clock.

## How does SmartMail meet the business email selection criteria?

[Smart360](https://digitalbridge.com.tr/en/smart360.html), the product family developed by Digital Bridge, covers business email, document management, an AI customer agent, access control, project management and e-commerce (SmartMail, SmartFiles, SmartOperator, SmartPass, SmartPM, SmartSales). On the email side the work is done by the [SmartMail business email service](https://digitalbridge.com.tr/en/smart360/smartmail.html), which runs alongside SmartFiles (business document management) under one admin panel and one identity, SmartID. Mapped to the eight criteria, SmartMail delivers the following:

- **Inbound analysis:** SmartMail puts every incoming email through three groups of checks: identity (it recalculates SPF, DKIM, DMARC and PTR results itself), structure (look-alike domains and international-character impersonation, display-name and brand impersonation, Reply-To and link mismatches) and content (the whole text, assessed with AI). The outcome is an assessment with a readable reason, and payment-detail signals such as an IBAN change are weighed together. Your organisation sets the quarantine threshold, and before you change it the system shows how many messages it would affect. For thresholds and release rights, use the rules in our [email quarantine policy](https://digitalbridge.com.tr/en/blog/email-quarantine-policy.html) article.
- **Shared mailbox permissions:** Each mailbox has nine separate permissions; delete and quarantine management are off by default for new assignments. Which right to give to whom is illustrated in our guide to [mailbox permissions and delegation](https://digitalbridge.com.tr/en/blog/mailbox-permissions-delegation.html).
- **Send approval:** A message going out in the company's name can be routed to one or more approvers; the author starts the request and chooses an "any one" or "all" rule; approval, revision with a stated reason and rejection are each recorded with date and time.
- **Identity lifecycle:** One password works across all products; a leaver's access is closed in one step, and when someone changes department their access changes in every product. Mailbox passwords are generated by the system, stored encrypted with AES-256-GCM and never handed out to staff.
- **Data separation:** Each organisation's data sits in a separate database for each product; the mail archive is kept in S3-compatible object storage. To move invoice and contract attachments out of mailboxes into document storage, see [saving email attachments to document storage](https://digitalbridge.com.tr/en/blog/save-email-attachments-to-document-storage.html).
- **Cost and setup:** There is no server to install — the account opens as soon as payment is confirmed; there is no setup fee and moving old mail at initial set-up is free. The single package is priced per mailbox and includes 5 domains regardless of mailbox count; to buy SmartMail, use the [Smart360 purchase page](https://smart360.com.tr/satin-al?urun=smartmail). Which items drive the price when you compare proposals is covered in [business email pricing factors](https://digitalbridge.com.tr/en/blog/business-email-pricing-factors.html).

In SmartMail, SPF, DKIM, DMARC and lookalike-domain checks are run by software, so they keep working even if the monthly AI usage allowance runs out. AI speeds up everyday work instead: message summaries, automatic classification and translation into 30 languages.

## What is the next step in choosing business email?

Start by scoring your current business email system against the eight criteria in this guide; the row with the most "no" answers is your priority. If payment fraud is a specific concern, read our guide to [bank detail change email fraud](https://digitalbridge.com.tr/en/blog/bank-detail-change-email-fraud.html); for the controls beyond email, see the [SME cyber security checklist](https://digitalbridge.com.tr/en/blog/sme-cyber-security-checklist.html). Every article from security to file organisation is gathered in our [Business Email & Documents guide](https://digitalbridge.com.tr/en/blog/topic/kurumsal-eposta.html).

If you would like to see SmartMail running on your own domain, or to have your current set-up scored against these eight criteria, [request a session through our contact page](https://digitalbridge.com.tr/en/contact.html).

## Frequently Asked Questions

### What is the difference between business email and free email?

Business email uses your company's own domain (for example name@yourcompany.com) and the accounts are controlled by the organisation. When someone leaves, the address and correspondence stay with the company and access is closed centrally. With free personal accounts that control sits outside the company, and you cannot set up the authentication records that protect your domain's reputation. Individual permissions and an audit trail on shared mailboxes are only possible with business email.

### Will we lose old emails when we switch provider?

Not with a properly planned migration. Existing mailbox content is moved to the new system, the MX change is scheduled outside working hours and incoming mail is monitored during the switch. Managing the migration timeline and user communication in a single plan is what makes the difference, and piloting with one department first exposes risks early.

### Does a small company really need SPF, DKIM and DMARC?

Yes. These records make it harder for anyone to send fake email in your domain's name and reduce the chance of your messages being filtered as spam. Major mailbox providers require them from high-volume senders, and they are considered good practice for small organisations as well. Once the records are live, reading DMARC reports regularly shows who is sending in your domain's name.

### What should foreign companies in Türkiye check for data protection?

Türkiye's Personal Data Protection Law (KVKK) makes your organisation the data controller for personal data in your mailboxes, much as the GDPR does in Europe. Ask where data is stored, how it is separated from other customers' data, who has access and whether access is logged. A provider's contract and technical measures support that responsibility but do not remove it. Tie retention periods to a written policy as well.

### How much does a business email service cost?

Business email pricing usually depends on the number of users or mailboxes, storage, whether security features are included or sold as add-ons, and migration and support. When comparing providers, look beyond the per-user licence to the total cost, including extra security products and administrator time. SmartMail has a single package priced per mailbox with no setup fee; current packages and terms are published on the product website.

### Does SmartMail need to be installed?

No. SmartMail needs no server and no licence file; the account opens as soon as payment is confirmed. The Smart360 team prepares and verifies your MX, SPF, DKIM and DMARC records, and you monitor their status in the panel. Moving old mail at initial set-up is free, and users and shared mailboxes are set up from one admin panel.