In this guide · 8 sections
- 01What 'email setup' should mean
- 02DNS records: MX, SPF, DKIM and DMARC
- 03Mailboxes, aliases and shared inboxes
- 04Security from day one: MFA and admin accounts
- 05Moving old email and setting up devices
- 06How to check your email setup was done right
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
A proper setup puts Microsoft 365 or Google Workspace in your company's name, adds MX, SPF, DKIM and DMARC records, creates aliases and shared inboxes, turns on MFA for everyone, sets up phones and laptops, moves old mail if needed, and hands over admin access and written notes.
What 'email setup' should mean
For most Singapore SMEs, business email means Microsoft 365 or Google Workspace on your own domain, such as you@yourcompany.com.sg. Whichever you choose, the setup has the same building blocks.
| Part of the setup | Why it matters | Often skipped? |
|---|---|---|
| Account and admin in your company's name | You can manage, pay and leave without asking anyone | Yes |
| Domain verified, MX records pointed | Mail actually arrives in the new mailboxes | No |
| SPF, DKIM and DMARC | Your mail is trusted and harder to spoof | Yes (DKIM and DMARC) |
| Aliases and shared inboxes | info@ and sales@ without shared passwords | Sometimes |
| MFA for all users | Stops most account takeovers | Yes |
| Phones and laptops set up | Staff can work on day one | No |
| Old email moved across | History and contacts kept | Depends |
| Signatures and handover notes | Consistent branding, you can manage it yourself | Yes |
DNS records: MX, SPF, DKIM and DMARC
DNS records are the settings on your domain that tell the internet where your email lives and which servers may send for you. Four matter:
- MX tells other servers where to deliver your mail. Google lists its values in Set up MX records for Google Workspace; Microsoft shows them when you add a domain to Microsoft 365.
- SPF lists the services allowed to send as your domain. There must be only one SPF record; see Google's SPF set-up guide.
- DKIM adds a signature to each message. In Google Workspace you must generate the key and start authentication in the Admin console (Set up DKIM); in Microsoft 365 you add two CNAME records and enable signing (Microsoft DKIM guide).
- DMARC tells receivers what to do with mail that fails, and sends you reports. Start at p=none and move to quarantine once every sender passes (Set up DMARC).
A setup that only adds MX records will deliver incoming mail but leave outgoing mail exposed to spam filtering and spoofing. Our SPF, DKIM and DMARC guide explains each record in more depth.
Security from day one: MFA and admin accounts
New tenants are the easiest time to set security up properly, before anyone gets used to bad habits. A good setup includes MFA for every user, with an authenticator app rather than SMS where possible, at least two admin accounts held by the business (one kept as a break-glass account), and staff mailboxes without admin rights.
If the setup provider keeps the only admin login, you do not really own your email. Our MFA set-up guide shows how to check and turn it on yourself.
Moving old email and setting up devices
If you are moving from a web host's email, a personal Gmail or another provider, the setup should include a migration plan. Done carelessly, mail sent during the switch can bounce or vanish.
Agree a cut-over date and time
Pick a quiet time, such as Friday evening. Tell staff not to delete anything from the old mailboxes for a few weeks.
Create mailboxes and verify the domain
Set up all users and aliases in the new service before touching MX records.
Copy existing mail, contacts and calendars
Use the built-in migration tools in Microsoft 365 or Google Workspace, or a third-party tool for larger moves.
Switch MX records
Point MX to the new service, then run a final sync to catch mail that arrived at the old host during the change.
Set up phones and laptops
Add the new account in Outlook or Gmail on each device, remove the old one, and test sending and receiving.
Keep the old account until everyone confirms
Do not cancel the old service until each user has checked their folders and contacts.
For a detailed walk-through of moving between providers, see our email migration guide.
How to check your email setup was done right
You can verify most of a provider's work yourself in 15 minutes, even without technical knowledge.
Email setup acceptance checklist
Do it yourself or get help?
If you have one or two users and are comfortable editing DNS, you can follow our business email setup guide yourself. Licence costs are covered in our business email cost guide.
If you want it done once and done properly, our Business Email Setup (S$249) covers Microsoft 365 or Google Workspace in your name for up to five people, with aliases, a shared inbox, MX, SPF, DKIM and DMARC, a signature template and a full admin handover. If your domain needs to be moved into your name first, Domain and DNS Setup (S$99) handles that. Already set up but landing in spam? The Emails Land in Spam Fix (S$249) repairs the records.
Frequently asked questions
Creating mailboxes takes minutes, but a complete setup usually spans one to three days. Domain verification and DNS changes need time to take effect, DKIM signing may start a little after the records are added, and moving old mail runs in the background. Plan the switch of MX records for a quiet period such as a weekend.
Always in your company's name. The Microsoft 365 or Google Workspace subscription, the billing and the main admin account should belong to the business, with the provider given a separate admin account you can remove. If the provider owns the account, you may struggle to get control back when you change suppliers.
Usually not. If one person handles it, an alias pointing to their mailbox is free. If several people answer it, use a shared mailbox in Microsoft 365 or a collaborative inbox Google Group in Google Workspace. Both avoid sharing a password, keep MFA possible and show who replied.
DMARC is a DNS record that tells receiving servers how to treat mail claiming to be from your domain that fails SPF and DKIM checks, and sends you reports. Gmail requires it for senders of 5,000 or more messages a day, and it helps everyone else resist spoofing. Start with a monitoring policy and tighten it later.
It should not. Email setup changes MX and some TXT and CNAME records, not the records that point to your website. Problems happen when someone changes nameservers or deletes records by mistake. Ask your provider to export your current DNS records before making changes so anything accidentally removed can be restored.