Getting business email right

A business running on personal Gmail addresses is a business with a problem it has not noticed yet.

## Why the address matters

Mail from a free address is trusted less, by the person reading it and by the systems that decide whether it reaches them at all.

But the real problem is ownership. When a member of staff leaves, mail sent to their personal address goes with them, along with everything in it: the customer conversations, the quotes, the history. The business never had it.

Email on your own domain belongs to the business. That is the whole argument, and it is enough.

## Workspace or 365

Both work. Google Workspace suits businesses that live in a browser and want something that stays out of the way. Microsoft 365 suits businesses that live in Excel and Word, because the desktop applications come with it.

If you have no strong feeling, pick the one your accountant and your staff already know. The migration cost of switching later is larger than the difference between them.

## The three settings that stop you landing in spam

This is where most set-ups are left half done.

**SPF** says which servers are allowed to send mail as your domain. Without it, anybody can, and receiving systems know that.

**DKIM** signs your mail so the receiver can verify it was not altered.

**DMARC** tells receivers what to do when the first two fail, and sends you a report about it.

All three are DNS records. All three take minutes to set up and are skipped constantly. If your mail lands in spam, this is where to look first.

## Shared drives, not personal ones

Set up shared drives from the start and put business files there. A file in somebody's personal drive is a file the business loses when they go, and the moment to fix that is before it matters rather than after.

## Two-factor, and a written way back in

Turn it on. An email account is the key to every other account, because every password reset goes through it.

Then write down how somebody would get back into the administrator account if the phone holding the codes was lost or stolen, and keep that somewhere safe. Businesses get locked out of their own email this way regularly, and the recovery is slow and painful.

## The invoice that changes bank details

The most expensive email fraud is also the simplest. Somebody gets into a supplier's mailbox, or registers an address that looks almost the same, and sends you a perfectly ordinary invoice with one change: the bank account. It arrives in the middle of a real conversation, so nothing about it looks odd.

The defence is a rule, not software. Any request to change where money is sent is confirmed by a phone call, to a number you already had, before anything is paid. Tell your suppliers you work this way and ask them to do the same for you. It takes two minutes and it is the one habit in this article that protects money directly.

The same rule applies inside the business. If an email that appears to come from the owner asks a member of staff to pay something urgently, to a new account, the answer is a phone call first. Make sure everybody knows they will never be blamed for checking.

## When somebody leaves

Have a routine, decided in advance: the password is changed, the mail is forwarded to whoever takes the work over, the files stay in the shared drive, the account is suspended rather than deleted for a period.

Doing this on the day is a five minute job. Doing it three months later, from memory, is not.