Email with your own domain gives you an address that moves with you: switch the provider, keep the address. That matters more than it sounds, because your inbox is where every password reset lands, so whoever controls the address holds the spare key to your accounts.
The short answer
How do you set up email with your own domain? You need a domain and a mail provider that supports custom domains. Then you publish four kinds of DNS records: MX says where mail for your domain is delivered, SPF lists the servers that may send for it, DKIM lets receivers verify a signature on each message, and DMARC tells receivers what to do when those checks fail and where to send reports. Choose the provider by where it stores your mail, how you get your mail out again and what it costs per user and month. A mail server on your home connection rarely works, because receivers distrust home IP addresses. We send our own mail from our own domain, too. Below we compare five providers using only their own statements as of 25 Oct 2026, rank none of them and use no partner links.
How it works
- Keep the domain and the mailbox apart. You rent the domain from a registrar, the mailbox lives with a mail provider, and the DNS zone can sit with either. That split is the point: if the provider stops suiting you, you change a few DNS records and keep every address. Let the domain renew automatically and give the registrar account a contact address outside that domain, so reminders do not land in the mailbox you are about to lose. For generic endings such as .com, ICANN requires registrars to send reminders about one month and one week before expiry, warns that email stops working while DNS service is disrupted after expiry, and requires registries to offer a 30-day Redemption Grace Period after deletion [33]. Country endings such as .de follow the rules of their own registry. Our assessment: once a lapsed name is free again, whoever registers it next receives your mail, password resets included.
- Choose the provider by storage location, export path and price. Read where the provider itself says it stores your mail, check whether standard protocols such as IMAP work or only its own apps, and compare the price per user and month, including VAT and billing period. The table after this list compares five providers. The export path matters most on the day you leave. Proton connects desktop email programs over IMAP and SMTP only through its app Proton Mail Bridge, which needs a paid plan [16]. Tuta does not support IMAP at all and points to exporting from its desktop clients [24]. mailbox.org documents ordinary IMAP, POP3 and SMTP servers [22]. If you need storage in Europe, check the edition: Google lists data regions for Business Standard, Business Plus and the Enterprise editions, among others, and Business Starter is not on that list [30]. Microsoft places Microsoft 365 customers with a sign-up location in the EU or EFTA inside its EU Data Boundary, with limited exceptions [27].
- Point the MX records to the provider. An MX record names a server that accepts mail for your domain, together with a preference number; lower values are preferred [1]. Enter exactly the hosts your provider gives you and delete MX records that point anywhere else. mailbox.org, for example, asks for four MX records, mxext1 to mxext4.mailbox.org, all with priority 10 [19]. Create every address and alias at the new provider before you switch. Proton warns that after the change, mail to addresses that do not exist in Proton Mail is not delivered [14].
- Publish exactly one SPF record. SPF is a TXT record on the domain itself. It starts with
v=spf1and lists the servers allowed to send with your domain in the envelope sender, usually through aninclude:that your provider names [2]. RFC 7208 allows one such record per name; two lead to an error result [2]. Evaluation also ends in an error if it needs more than 10 terms that trigger DNS lookups, such asinclude,a,mxorredirect, and terms inside included records count too [2]. The last term covers everyone else:-allmeans fail,~allsoftfail [2]. Use the qualifier your provider documents, and add new services to the existing record instead of creating a second one. - Switch on DKIM. With DKIM, the provider signs every outgoing message, and receivers check the signature against a public key that you publish under a selector, for example
sel1._domainkey.example.com[3]. Some providers give you a TXT record with the key, others CNAME records, so they can rotate the key themselves. Microsoft 365 uses two CNAMEs,selector1._domainkeyandselector2._domainkey[13]; Proton asks for three DKIM records [14]. RFC 8301 requires RSA keys of at least 1,024 bits and recommends at least 2,048 [4]. Google requires at least 1,024 bits for mail to personal Gmail accounts and recommends 2,048 [10]. If your provider lets you choose, take 2,048. - Start DMARC gently. DMARC lives in a TXT record at
_dmarc.example.com. It checks whether the domain in the visible From address matches a passing SPF or DKIM check, says what receivers should do with mail that fails, and asks for reports. Since May 2026, RFC 9989 defines DMARC and replaces RFC 7489; aggregate reports now have their own RFC 9990 [5][6]. The record must start withv=DMARC1;p=takesnone,quarantineorreject;rua=names the address for aggregate reports [5]. RFC 9989 drops the oldpcttag and addst=y, a test mode in which receivers apply the next less strict policy, soquarantineis treated likenone[5]. Start withp=noneand a report address, read the reports, then tighten. Proton recommendsp=quarantinefor most domains [14]. RFC 9989 adds two warnings: domains whose users might post to mailing lists should not publishp=reject, and a domain withp=rejectmust not rely on SPF alone but must sign its mail with DKIM [5]. - Know what the big inboxes demand. Since 1 Feb 2024, Google has required every sender to use SPF or DKIM, valid forward and reverse DNS for sending servers, TLS and a spam rate below 0.3 percent [10]. Anyone sending more than 5,000 messages a day to Gmail accounts also needs SPF and DKIM, DMARC with at least
p=none, a From domain aligned with SPF or DKIM, and one-click unsubscribe for marketing mail [10]. Yahoo has comparable rules for all senders and for bulk senders; enforcement began in February 2024 [11]. Since 5 May 2025, Microsoft has required SPF, DKIM and DMARC with at leastp=nonefrom domains sending more than 5,000 messages a day to Outlook.com; it sends failing mail to junk and may later reject it with error 550 5.7.515 [12]. With a mail provider, servers, reverse DNS and TLS are its job. Your job is the DNS records. - Move without losing mail. Lower the TTL of your MX records well before the switch, wait at least one old TTL, then change them, and raise the TTL again afterwards (see the DNS TTL page). Proton suggests a TTL of 300 seconds while you verify the domain, so changes show up within five minutes [14]. Keep the old mailbox reachable for a while, because servers with cached answers may still deliver there. Copy your old mail with the new provider's import tool or an IMAP client; Proton's Easy Switch, for example, imports from any provider that offers IMAP [18]. Then replace the old provider in your SPF record, add the new DKIM records and keep DMARC at
p=noneuntil the reports show only the new provider. - Forward with care. If an old address forwards to the new one, SPF stops helping. It fails at the destination unless the forwarder is part of the original sender's authorised infrastructure, and if the forwarder rewrites the envelope sender, SPF can pass only for the forwarder's domain, which does not match the visible From address [7]. DKIM signatures can survive if the forwarder changes neither the content nor important header fields [7]. Mailing lists often add a subject tag or a footer and thereby break DKIM [7]. That is why your own mail needs a DKIM signature, and why importing old mail once is often cleaner than forwarding forever.
- Leave the home mail server alone. Spamhaus lists address ranges in its Policy Blocklist that should not send mail directly to the internet, often ranges that providers assign to broadband customers, and stresses that a listing is not caused by anything the user did [32]. It also says outbound port 25 should be limited to mail servers [32]. Google expects valid reverse DNS for sending servers [10], and on a home connection your provider sets that PTR record (see the Reverse DNS page). Our assessment: receiving mail at home can work, sending reliably rarely does. If you want your own server anyway, rent one with a fixed address and a PTR record you can set.
Five providers compared (as of 25 Oct 2026)
| Provider and plan | Own domain | Price, as stated by the provider | Storage location, as stated | Access and export |
|---|---|---|---|---|
| Proton Mail Plus | 1 domain, 10 addresses, 15 GB [15] | €4.99 per month, or €47.88 per year [15] | servers "exclusively located in Switzerland, Germany or Norway" [17] | web and apps; IMAP and SMTP for desktop programs only through Proton Mail Bridge, paid plans only [16] |
| mailbox.org Standard | custom domains with Standard or Premium for individual accounts [19] | €3 per month, paid annually, for new customers since 15 Jul 2026 [20] | two separate locations in Berlin [21] | IMAP, POP3 and SMTP [22] |
| Tuta Revolutionary | 3 domains, 15 extra addresses, 20 GB [23] | €3 per month paid yearly, or €3.60 per month paid monthly, per a Tuta blog post of 19 Aug 2026 [35] | data centres in Germany [25] | no IMAP; export from the desktop clients [24] |
| Microsoft 365 Business Basic | custom business address included [26] | €6.07 per user and month, billed annually, plus VAT [26] | EU Data Boundary for customers with an EU or EFTA sign-up location [27] | IMAP and POP; Microsoft names outlook.office365.com as an example server [28] |
| Google Workspace Business Starter | included; 30 GB pooled storage per user [29] | – | Starter is not among the editions with data regions [30] | not covered by the pages we read |
How to read it: these are the providers' own statements on 25 Oct 2026, not measurements, and the order means nothing. Prices and plans change, so check the date. For Google Workspace we list no price, because its pricing page showed us only US-dollar amounts; check the price for your country there [29]. We did not test any of these services for this guide. Bytearium may later add partner links to some providers. If we do, they will be marked, and the criteria above stay the same.
The DNS records at a glance
All names and values below are placeholders. Replace example.com with your domain and the mail-provider.example hosts with the values your provider gives you.
example.com. 3600 IN MX 10 mx1.mail-provider.example.
example.com. 3600 IN MX 20 mx2.mail-provider.example.
example.com. 3600 IN TXT "v=spf1 include:_spf.mail-provider.example ~all"
sel1._domainkey.example.com. 3600 IN CNAME sel1.dkim.mail-provider.example.
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"In your DNS provider's web form you usually enter only the name part: @ or an empty field for the domain itself [14], and for the others the part before your domain, here _dmarc or sel1._domainkey. Once the reports look clean, tighten the policy to v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com. A domain that neither sends nor receives mail gets a null MX, example.net. 3600 IN MX 0 ., plus the SPF record v=spf1 -all, which states that no server sends mail for it [8].
Check your records
dig +short MX example.com
dig +short TXT example.com
dig +short CNAME sel1._domainkey.example.com
dig +short TXT _dmarc.example.comdig asks a name server for one record type, and +short prints only the answer [34]. If your provider publishes DKIM as a TXT record, ask for TXT instead of CNAME. Then send a message to an account at another provider and open the full header: in Gmail, open the message and, next to Reply, choose More, then Show original [31]. Look for the Authentication-Results field, which RFC 8601 defines for receivers to record their results, such as spf=pass, dkim=pass and dmarc=pass [9].
A worked example
This is invented, not a test. Mara owns example.org and has so far used the mailboxes of a web hosting package. She wants a mail provider with custom domain support. On Monday she lowers the TTL of her MX records from 3,600 to 300 seconds and creates her two addresses at the new provider. On Tuesday, more than an hour later, she replaces the MX records, adds the provider's DKIM records, rewrites her SPF record so that it includes only the new provider, and publishes DMARC with p=none and a report address. dig shows the new values. A test message to a Gmail account shows spf=pass, dkim=pass and dmarc=pass in the header. She imports her old mail over IMAP, keeps the old package for another month and moves DMARC to p=quarantine once the reports list only the new provider. Nothing in this example was measured.
Checklist
- Check that your domain renews automatically and that the registrar account uses an address outside that domain.
- Compare providers by storage location, IMAP or export path, and price per user including VAT and billing period.
- Create every address at the new provider before you change the MX records.
- Lower the TTL at least one old TTL before the switch, and raise it again afterwards.
- Keep exactly one SPF record, and keep the terms that need DNS lookups at 10 or fewer, counting those in included records.
- Switch on DKIM, with 2,048-bit keys if your provider offers them.
- Publish DMARC with
p=noneand a report address first, then tighten it toquarantine. - Send a test message and read the Authentication-Results field.
- Protect the mailbox itself with passkeys or two-factor authentication, because it can reset your other accounts.
- Give domains that send no mail a null MX and
v=spf1 -all.
Data protection, briefly
If you use the address for business, questions about data protection and record keeping come up, for example which contracts a provider offers for processing your data. Those are legal questions. We do not answer them here; ask a specialist.
Related pages: DNS / name resolution; Reverse DNS (PTR): from IP address to name; DNS TTL (time to live); Account hacked: what matters in the first hour; Passkeys and 2FA: secure your accounts.