Business email is email that runs on your company's own domain (name@yourcompany.com) and whose accounts are controlled by the organisation rather than by individuals. It differs from free personal email in more than the address: it protects your domain with authentication records, gives people their own access to shared mailboxes, shuts off a leaver's access and keeps correspondence on the company's record.
Key takeaways
- Business email is email where the company, not the employee, owns the address and the account.
- With free personal email the account belongs to the person, so customer correspondence can walk out with them.
- The FBI IC3 2025 report puts reported business email compromise (BEC) losses in the US at $3.05 billion.
- Google and Microsoft now expect SPF, DKIM and DMARC from high-volume senders, and you can only set these up on a domain you own.
- A good business email service brings domain protection, shared mailbox permissions, sending controls and archiving together.
What exactly is business email?
Business email has three parts: a domain the company owns, a service that handles email for that domain, and an admin console for managing accounts. Addresses look like sales@yourcompany.com, and whoever controls the domain controls the email. We walk through the setup in our guide to setting up email with your domain.
When people say "ordinary email" they usually mean free personal accounts such as Gmail, Outlook.com or Yandex. These are built for individuals: the address sits on the provider's domain, the account belongs to whoever opened it, and the company has no legal or technical control over it. The practical risks of running a company on a free account are covered in using Gmail for business email.
One distinction is worth making. The business plans offered by the big providers are business email too, because they run on your own domain with an admin console. What decides it is less the brand than who owns the account and who manages it.
How does business email differ from personal email?
The clearest way to see the gap is to ask both models the same questions. The table below covers situations a small or mid-sized firm runs into in day-to-day correspondence.
| Topic | Free personal email | Business email |
|---|---|---|
| Address | firstname.lastname@gmail.com | name@yourcompany.com |
| Account owner | The person who opened it | The company |
| When someone leaves | Correspondence stays with them | Access closed in one step, mailbox stays |
| Domain protection (SPF, DKIM, DMARC) | Not possible; the domain is the provider's | Set up and monitored on your own domain |
| Shared mailboxes (info@, accounts@) | Password shared, no record of who did what | Individual access and an activity log |
| Archiving and retention | Down to the individual's delete key | Follows the company's policy |
| Trust and reputation | Customers cannot tell a fake account from the real one | Address carries your brand; spoofs stand out |
| Support | Generic help pages | Contracted support and admin tools |
The row that matters most is account ownership. A customer relationship run from a free account effectively leaves with the employee. For the steps to close access properly, see our checklist on offboarding email access.
What does running a business on free email cost?
The most visible cost is fraud. According to the FBI IC3 2025 Internet Crime Report, 24,768 BEC complaints in the US reported total losses of $3.05 billion in 2025, making BEC the second most costly crime type after investment fraud. What these attacks share is an attacker posing as a supplier or a manager over email.
A firm working from personal addresses has little defence against that. Anyone can register companyname.accounts@gmail.com, and your customers have no way of telling the real address from the fake. On your own domain, once DMARC is set to an enforcing policy, an attacker is usually left with registering a lookalike domain, which leaves a trail that can be detected.
The second cost is deliverability. Since 1 February 2024, Google has required senders of more than 5,000 messages a day to Gmail to set up SPF, DKIM and DMARC. Microsoft followed from 5 May 2025, applying the same requirements to high-volume domains sending to Outlook.com addresses.
The third cost is quieter: lost knowledge. When quote history, contract attachments and customer threads are scattered across personal inboxes, answering "who wrote what, and when?" during a dispute becomes hard. In Turkey, Article 82 of the Turkish Commercial Code requires merchants to keep incoming and copies of outgoing business letters, and some email correspondence may fall within that scope.
What are the technical foundations of business email?
The trustworthiness of business email rests on a handful of DNS records added to your domain. They answer the receiving server's question: "did this message really come from this company?"
- MX: tells the world which server should receive mail for your domain.
- SPF: lists the servers allowed to send mail on behalf of your domain.
- DKIM: adds a digital signature to outgoing mail, proving the content was not altered in transit.
- DMARC: tells receivers what to do if SPF and DKIM fail, and sends you reports.
For a step-by-step look at what each record does, read SPF, DKIM and DMARC explained. The key point is that these records can only be published on a domain you control. On a free address, you have no way to manage your domain reputation.
How do you switch to business email?
Done in the right order, a switch at a small company can usually be completed in a few days without interrupting the business. The sequence below is a practical roadmap for small and mid-sized companies.
- Take an inventory: who uses which address, which addresses are shared (info@, sales@, accounts@), and which personal addresses do customers know?
- Secure the domain: make sure it is registered to the company and that its renewal date is tracked.
- Choose the service: look at security, permissions and archiving before mailbox size. The eight criteria in how to choose a business email service are built for this comparison.
- Publish the DNS records: add MX, SPF, DKIM and DMARC; start DMARC in monitoring mode and tighten it as you read the reports.
- Migrate old mail: move past correspondence into the new mailboxes. Planning details are in our email migration guide.
- Set up shared mailbox access: give each person access under their own identity instead of sharing a password.
- Tell your contacts: put an auto-reply on old personal addresses and announce the new one in signatures.
On budget, count migration, support and admin time as well as licences; the line items are broken down in business email pricing factors.
Why are shared mailboxes a separate issue?
Most of the trouble sits not in personal mailboxes but in shared mailboxes such as info@ and accounts@. Their passwords tend to circulate around the team, and nobody can say who deleted a message or what reply went to whom. A leaver who knows the password may keep their access.
In a proper business setup, everyone signs in to a shared mailbox with their own identity and permissions are granted per person. That lets you draw lines such as "can read but cannot delete". Practical advice is in our guide to shared mailbox management.
How does SmartMail make this easier?
SmartMail is the business email service in Digital Bridge's Smart360 product family. It manages shared and personal mailboxes from a single web panel, re-checks every incoming email itself with SPF, DKIM and DMARC, and defines nine separate permissions for each mailbox.
Picture a trading company that has run info@ and accounts@ on a shared password for years, while its sales team handles some customers from personal addresses. When it moves to SmartMail, the Smart360 team prepares and verifies the DNS records (MX, SPF, DKIM, DMARC, MTA-STS and TLS-RPT), and migrating old mail at first setup is free of charge. Staff sign in to shared mailboxes with their own Smart360 identity and never learn the mailbox password; delete and quarantine rights are switched off by default on new assignments.
A few weeks later, accounts@ receives a "we have changed our bank details" email from an address one letter away from a supplier's domain. SmartMail runs it through identity, structure and content checks and flags both the lookalike domain and the IBAN change request, with the reason shown. Below the trust threshold, the message never reaches the inbox; it waits in quarantine with its explanation. Outgoing mail on the company's behalf, such as a payment confirmation, can be sent with "Send with approval" so a manager signs it off first.
When a salesperson leaves, their access is removed from a single screen, and because scheduled emails are re-checked at the moment of sending, anything they queued will not go out in the company's name. You can explore every feature on the SmartMail product page.
How can Digital Bridge help with the move?
Digital Bridge treats a business email migration as a security project, not just a software handover. We map your current addresses, review the domain and DNS set-up, and plan the migration so that day-to-day work carries on.
On the policy and awareness side of phishing and payment-redirection risk, we offer cyber security consultancy. For organisations that want SmartMail and SmartFiles under one identity, we also set up the Smart360 family. To help your team recognise fake messages, how to spot phishing emails is a good place to start.
What is the next step towards business email?
Start by writing down where you stand today: how many personal addresses are used for work, how many shared mailboxes exist, and who knows their passwords. That list sets the scope and priorities of the switch. Related articles are collected on the business email topic page.
When you are ready, look through SmartMail on the product page and get started by choosing your number of mailboxes on the SmartMail purchase page. If you would rather plan the set-up and migration together, get in touch.