What actually goes wrong when a business emails from a free address, the contact form fix that costs nothing, and when the mailbox in your hosting is enough.
A builder sends a quote for a £40,000 extension from an address like builder1987@hotmail.com. The work might be excellent. The quote still reads like it came from someone who may not be around next year, and the customer comparing three quotes notices.
That is the soft version of the problem. Underneath it there is a harder, more technical version, and most articles on this subject get that part wrong. This one tries not to.
What actually goes wrong, and what does not
If you type an email in Gmail's own website or app and send it from your @gmail.com address, there is no technical problem at all. Google signs the message on its way out, and the server receiving it can confirm the mail really came from Google. Nothing is going to bounce.
The problem starts when something that is not Gmail sends mail carrying your Gmail address: your website contact form, a booking system, an invoicing app, a CRM, a newsletter tool. Those servers are not authorised to send on behalf of gmail.com, so the message fails the checks that receiving servers now run as a matter of routine. Any automation that sends mail for you runs into the same wall.
The bit most articles get wrong
You will read that Gmail blocks mail sent from a @gmail.com address by anything other than Gmail. On 28 August 2026 we looked up the published policies ourselves, and that is not what they say.
gmail.com publishes a policy of p=none, which tells a receiving server to take no action when a message fails those checks. The mail is not rejected on policy grounds. It drops into ordinary spam scoring, unauthenticated, which is not a good place to be, but it is not a bounce.
yahoo.com, yahoo.es and aol.com are a different matter. All three publish p=reject. If a form puts a visitor's Yahoo address in the From line, that message really can be refused outright. hotmail.com and outlook.com publish p=none today.
So the free-address problem is real, but it is far sharper for Yahoo and AOL than it is for Gmail.
The contact form fix, which costs nothing
This one is concrete and you can check it today. Your website's form should send from an address on your own domain, for example web@yourdomain.com, and put the visitor's address in the Reply-To header. You press reply, the reply goes to the customer, which is what you wanted anyway.
What it must not do is put the visitor's address in the From line. That turns the notification into an unauthenticated impersonation of the visitor's own domain. It fails SPF and DMARC alignment, and it is refused outright when the visitor is on Yahoo, AOL or a company domain with a strict policy. The failure is silent. Nobody tells you, there is no bounce sitting in your inbox to find, there is just an enquiry you never saw.
It is the first thing we check on any website that comes to us from another agency, and we see it most on websites for builders, where the job is large and yours is one of three quotes landing in the same inbox.
The rules that changed, and who they apply to
Google's sender guidelines apply to everyone, at any volume. They ask you to set up SPF or DKIM for your sending domain (or, not both), to have valid forward and reverse DNS records for the sending server, to use a TLS connection, to keep spam complaints below 0.3%, to format messages to the RFC 5322 standard, and not to impersonate Gmail in your From headers.
There is a second, stricter list, and it applies to bulk senders only. Google defines a bulk sender as anyone sending close to 5,000 messages or more to personal Gmail accounts within a 24-hour period. Those senders need SPF and DKIM, both, plus a DMARC record (p=none is enough to satisfy it), alignment between the From domain and one of the two, and one-click unsubscribe on marketing mail. The requirements became enforceable on 1 February 2024.
If you send twenty quotes a day, that second list is not about you. Anyone telling you the Gmail bulk rules oblige you to do something is selling you something. One detail is worth knowing anyway: Google says bulk sender status has no expiry date and is permanent once assigned, and that changing your sending habits later does not remove it. Run one 5,000-recipient campaign and the stricter rules stay with you.
Microsoft went the same way from 5 May 2025, with the same 5,000-a-day threshold for mail sent to consumer Outlook.com, Hotmail.com and Live.com addresses.
SPF, DKIM and DMARC in a paragraph each
SPF is a record in your domain's DNS listing which mail servers are allowed to send for you. The receiver checks the connecting server against that list. It validates the technical return path, not the From line a human reads.
DKIM adds a cryptographic signature to each message using a private key you hold, with the matching public key published in your DNS. The receiver can confirm the message came from your domain and was not altered on the way.
DMARC ties those two to the From address the customer actually sees. It requires the domain in the From line to align with the domain SPF or DKIM validated, tells receivers what to do when neither aligns (p=none: nothing, p=quarantine: spam folder, p=reject: refuse it), and asks for reports. That is the part worth understanding: SPF and DKIM on their own do not protect the From line your customer reads. DMARC is what does.
DMARC is not new. It dates from 2012, and in May 2026 it was published as RFC 9989 and promoted to a Proposed Standard on the standards track, replacing the older informational RFC 7489. That does not make it mandatory for you. It does mean every mail provider is now working from the same document.
If you do publish a DMARC record, start at p=none and read the reports for a few weeks before tightening anything. A small business usually has mail leaving from more places than the owner realises: the website form, a booking tool, the accountant's invoicing system. Jumping straight to p=reject is a reliable way to make your own invoices disappear.
What it costs, and when hosting mail is enough
There are three realistic routes.
Google Workspace gives you the familiar Gmail interface on your own domain. Google's entry plan was listed at £5.90 per user per month at standard price when we checked, with 30 GB of storage per user and a 16% saving for committing annually, and promotional discounts often run for new customers. There is no free version with a custom domain. Google withdrew that years ago.
Microsoft 365 Business Basic suits a business that already lives in Outlook, Word and Excel. Microsoft's Spanish site lists it at 6,07 € per user per month excluding VAT, on an annual commitment that renews automatically, with 1 TB of storage per user.
The mailbox included with your web hosting is usually free with what you already pay. For a one-person trade taking a handful of enquiries a day it is genuinely enough, and we will say that even though we sell hosting. Its real weaknesses are smaller storage, weaker spam filtering and webmail that is noticeably worse to use than Gmail or Outlook. Authentication is not one of them: SPF and DKIM can be configured on all three routes.
One thing we will not promise
Moving to your own domain will not get your mail into the inbox. Microsoft says as much in its own documentation: passing SPF, DKIM and DMARC "does not guarantee inbox placement". Filtering also weighs the sending server's reputation, your domain's reputation, complaint rates and the content itself. A brand new domain has no reputation at all and can perform worse than a ten-year-old Gmail address for the first few weeks. Set it up, use it steadily, and do not send a mass mailing in week one.
Frequently asked questions
Do I have to stop using Gmail?
No. Mail you type and send in Gmail's own interface authenticates correctly. The case for your own domain is about what the customer sees on the From line, and about being able to authenticate the automated mail your website and tools send on your behalf.
Can I use the Gmail app with an address on my domain?
Yes, with a paid Google Workspace subscription. What you cannot do is attach a custom domain to a free Gmail account. That option no longer exists.
Do SPF, DKIM and DMARC stop spam?
No. They let a receiving server check whether mail claiming to come from your domain really does, and let you say what should happen when it does not. Spammers sending from their own properly authenticated domains pass all three quite happily.
How do I tell if my contact form is set up correctly?
Open the last enquiry notification your site sent you and look at the From line. If it shows the visitor's address, that is the pattern to change. If it shows an address on your own domain and pressing reply still reaches the visitor, it is already right.
How many mailboxes do I need?
One per person who reads mail. Extra addresses such as info@ or quotes@ that deliver into an existing mailbox are usually included rather than charged per address, but check the plan you are on.
The short version: fix the From line on your contact form this week, and treat moving your mailbox as a separate, calmer decision. If you would like us to look at how your form sends and what your domain currently publishes, get in touch and we will go through it with you.