How to Set Up Custom Email Address with Your Domain

Why use email on your own domain

An address like you@yourcompany.com looks more trustworthy than a free webmail address, keeps your identity consistent with your website, and, most importantly, belongs to you. If you change mail providers later, you keep the address and simply update DNS. With a free address tied to a provider, you are locked in.

Setting it up is not difficult, but it touches DNS, and small mistakes there lead to lost or spam-foldered mail. This guide walks through the whole process in plain terms.

What you need before you start

• A registered domain. If you do not have one yet, start with a domain search. Short, easy-to-spell names work best for email because people have to type them.
• Access to your DNS. This is usually at your registrar, your hosting control panel or a DNS provider such as a CDN. A WHOIS lookup shows which name servers your domain uses, which tells you where DNS is actually managed.
• A mail provider. Options are covered below.

Choosing an email provider

There are three common routes. Prices and limits change frequently, so check current plans with each provider.

For a business that relies on email, a dedicated mail provider is usually worth it. For a personal site or side project, hosting mail or forwarding can be enough. If you use hosting mail, our guide to email filters and forwarders in cPanel covers the panel side.

Step 1: Add the MX records

MX (mail exchanger) records tell sending servers where to deliver mail for your domain. Your provider will give you one or more hostnames and priority values. Lower numbers are tried first.

; example values only - use the ones your provider gives you
example.com.  3600  IN  MX  10  mx1.mailprovider.example.
example.com.  3600  IN  MX  20  mx2.mailprovider.example.

Important details:

• MX records must point to a hostname, never directly to an IP address, and that hostname must not be a CNAME.
• Remove old MX records from a previous provider, or some mail will keep going there.
• Many DNS panels use @ to mean the root domain. Enter the host field exactly as your DNS provider expects.
• Lowering the TTL a day before the switch makes a later rollback faster. See DNS TTL settings.

Step 2: Publish an SPF record

SPF (Sender Policy Framework) is a TXT record listing which servers are allowed to send mail for your domain. Receiving servers check it to spot forged senders.

example.com.  3600  IN  TXT  "v=spf1 include:_spf.mailprovider.example ~all"

• One SPF record only. If you send through several services (your mailbox provider, a newsletter tool, a helpdesk), combine them into a single record with multiple include: mechanisms. Two separate SPF records make SPF fail.
• Stay under 10 DNS lookups. Each include can trigger further lookups; exceeding the limit causes a permanent error.
• ~all vs -all. ~all (softfail) is a common starting point; -all (fail) is stricter once you are sure every sender is listed.

Step 3: Enable DKIM signing

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing message. The public key lives in DNS so receivers can verify that the message was sent by an authorised server and not altered in transit.

Your provider generates the key pair. You publish the public part, usually as a TXT record or a CNAME, under a selector name:

selector1._domainkey.example.com.  3600  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...AB"

Then switch DKIM signing on in the provider’s admin console. Many providers will not start signing until they detect the record, so check back after DNS updates. Use 2048-bit keys where the provider and your DNS host support them. Long keys may need to be split into multiple quoted strings in some DNS panels.

Step 4: Add a DMARC policy

DMARC ties SPF and DKIM together. It tells receivers what to do when a message claiming to be from your domain fails both checks (or fails alignment), and where to send reports.

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

1. Start with p=none: nothing is blocked, but you receive aggregate reports showing who is sending as your domain.
2. Review the reports for a few weeks and add any legitimate senders you missed to SPF and DKIM.
3. Move to p=quarantine, then to p=reject once legitimate mail passes consistently.

Major mailbox providers now expect bulk senders to have SPF, DKIM and DMARC in place, and even small senders benefit. For a deeper walkthrough of policies, alignment and reports, read our DMARC and SPF email security setup guide.

Step 5: Test everything

DNS changes can take from minutes to a day or two to be visible everywhere, depending on TTLs. Once they are live, verify them:

dig MX example.com +short
dig TXT example.com +short
dig TXT selector1._domainkey.example.com +short
dig TXT _dmarc.example.com +short

• Send a message to an external mailbox (for example a free webmail account) and open the original message headers. Look for spf=pass, dkim=pass and dmarc=pass.
• Reply from the external mailbox to confirm inbound delivery works.
• Configure your phone and desktop mail clients using the provider’s IMAP/SMTP or app settings, with encrypted connections.

Common mistakes to avoid

• Leaving the old provider’s MX records in place, so mail arrives in two places.
• Two SPF records after adding a newsletter tool. Merge them.
• Forgetting third-party senders such as invoicing, CRM or website contact forms, which then fail DMARC.
• Sending website form mail from your domain via the web server without SPF/DKIM coverage. Use authenticated SMTP or the provider’s API instead.
• Jumping straight to p=reject before reviewing reports.
• Letting the domain expire. When a domain lapses, mail stops being delivered, and if someone else registers it later, they could receive mail meant for you. Turn on auto-renew, keep registrar contact details current, and track the expiry date in the TLDix domain panel for an independent reminder.

Aliases, shared mailboxes and catch-all addresses

Once the basics work, think about how addresses are organised. Paid plans are often priced per mailbox, but most providers let you add aliases such as info@, billing@ or support@ that deliver into an existing mailbox at no extra cost. Shared mailboxes or groups are better for team addresses, because access can be granted and revoked without sharing a password when someone leaves.

Be careful with catch-all addresses that accept mail for any name at your domain. They make sure typos still reach you, but they also attract large amounts of spam sent to random addresses. If you enable one, filter it aggressively or review it occasionally rather than reading it daily.

Security for the mailbox itself

Authentication records protect your domain from being spoofed, but they do not protect the account. Turn on two-factor authentication for every mailbox and especially for the admin account, use unique passwords, and review which apps have access to the mailbox. Your email account is usually the recovery address for everything else, including your registrar, so a compromised inbox can quickly become a compromised domain. Our guide to securing your registrar account covers the related steps.

Quick reference

With these four records in place and your domain renewal under control, your custom email address will be professional, portable and much harder for anyone else to impersonate.