Why Your Business Email Still Runs on Free Gmail

Your invoices still come from johnkamau254@gmail.com.

You have a registered business, a website and probably a domain name. But the tender response a procurement officer opens says yourcompany.tenders@yahoo.com, and the follow-up to a customer's M-Pesa payment comes from somebody's personal account. We know why. Gmail is free, it works, and "proper email" sounds like a project.

It is a small project, and the cost of skipping it shows up in two places: how you look in an inbox, and how easy you are to impersonate. CloudSpinx moves businesses in Kenya off free accounts and onto business email they actually control, so here is what that involves, what the suites cost, and how the move happens without losing a message.

What the address tells a client

When you email a potential client from john.kamau.biashara@gmail.com, you are telling them something about your business whether you mean to or not: that nobody has set up the basics yet.

That is not fair to your work. It is how the inbox gets read anyway, and it is read before anyone opens the attachment. On a tender, the address is the first thing the evaluator sees from you.

The fraud problem is the serious one

A free Gmail account is not unauthenticated. Google signs and publishes records for gmail.com like any serious mail provider. The problem is that gmail.com belongs to Google, not to you, so nothing stops a scammer from opening johnkamau254.accounts@gmail.com and writing to your customers that your bank details have changed. Your customer has no way to tell the two apart, pays the wrong account, and the conversation that follows is with you.

On your own domain the picture flips. You publish SPF, DKIM and DMARC records that tell every receiving server which systems may send as yourcompany.co.ke, and what to do with a message that fails. A forged message on your exact domain gets quarantined or rejected before your customer reads it. Lookalike domains are still possible, but your customers learn one address and it is yours.

We check email authentication on every cybersecurity engagement, because the records cost nothing and the failure they prevent is a payment going to the wrong account.

Microsoft 365, Google Workspace or Zoho

Three realistic options for a Kenyan business. The two big suites now list the same price at entry level, so the choice is about storage and tools rather than money:

Prices are from Microsoft's 2026 price update and Google's pricing page. Fifteen people on either suite's entry plan is USD 105 a month. Month to month costs a fifth more on both.

For most small teams we would pick Google Workspace. Everyone already knows Gmail, and Android carries about 95% of Kenya's mobile web traffic on StatCounter's count, so the phone app your staff will actually use is the one they have. Pick Microsoft 365 when your clients trade Office documents or you need installed Excel, which starts at Business Standard. Starter's 30 GB pool is the thing to watch: a mailbox-heavy team runs into it before a Microsoft team runs into 100 GB. The full Microsoft 365 against Google Workspace comparison works through that tier by tier.

Zoho works. The mail is reliable. The calendar and documents are less polished, and your staff will take longer to settle in.

What SPF, DKIM and DMARC actually do

All three are DNS TXT records on your domain. If yours has none, fix that before anything else in this post.

SPF (Sender Policy Framework) lists the servers allowed to send mail for your domain. For a business sending only through Google Workspace, Google's own record is one line:

v=spf1 include:_spf.google.com ~all

DKIM (DomainKeys Identified Mail) signs every outgoing message. The receiving server checks the signature against a public key you publish in DNS, and a message that fails was either altered or forged.

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ...

DMARC tells receiving servers what to do with mail claiming your domain that fails both checks, and where to send reports:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourcompany.co.ke; pct=100

That record says quarantine the forgeries and tell us someone tried. Google Workspace and Microsoft 365 both hand you the exact SPF and DKIM values during setup. What they do not do is publish them for you, and an unaligned record is why Outlook starts rejecting your mail. Our email and collaboration team does all three as part of every migration.

Moving without losing a message

The fear we hear most is "what if we lose our old emails". The order of work is what prevents it.

Build the new platform first. Create every user on Google Workspace or Microsoft 365 and leave DNS alone. Old mail keeps flowing to the old place.

Copy the history. Both suites have migration tools that pull existing mail from Gmail, Yahoo or any IMAP server, folders and attachments included. It runs in the background, and how long depends on how much mail there is.

Have each user check their own account. Old mail present, folders right, phone and laptop signed in. Nobody signs off on someone else's mailbox.

Switch the MX record. This is the moment new mail starts landing on the new platform. For Google Workspace it is now a single record, per Google's setup page:

@   MX   1   smtp.google.com.

Add SPF, DKIM and DMARC, as above.

Watch both systems. Google says a new MX record can take up to 72 hours to be recognized everywhere, so for those days some senders still deliver to the old server. Leave it running, and copy across whatever lands there.

That last step is where mail actually goes missing, and it is not where most people look. We tested what a final sync pass copies, skips and deletes around the switch in where mail gets lost at cutover. We schedule the MX change for a Saturday morning, when mail volume is lowest.

Should you run your own mail server?

Usually not. Running one means owning all of this, permanently:

• Patching a server that is a standing target
• Spam filtering, which never stops changing
• Your sending IP's reputation, so your mail does not land in spam
• SPF, DKIM, DMARC, TLS certificates and DANE
• Mailbox backups, webmail and storage that someone keeps filling

Under about fifty mailboxes, with no rule that the data must stay on hardware you control, a hosted suite is the honest answer and a mail server is a hobby you are paying for. Past that size, or with a residency requirement, self-hosting earns its keep, and that is a Zimbra mail server conversation rather than a Postfix weekend.

Three things to do this week

Even before you migrate:

1. Register your domain if you have not. A .co.ke comes from any KENIC-accredited registrar.
2. Stop sharing accounts. Five people on one sales@gmail.com means nobody is accountable for what it sends, and one leaked password exposes all of it. Give each person their own.
3. Turn on two-factor authentication everywhere, with an authenticator app rather than SMS, because SIM swap fraud is how SMS codes get stolen in Kenya.

When you are ready for the full move, our managed IT team handles it end to end: DNS, the mail copy, phones and laptops, and the first week of questions. If the website is due for work too, we often do both together.

Frequently Asked Questions

Will we lose any emails during the migration?

No, if the order above is followed. History is copied before the MX record changes, and the old system stays up until nothing more arrives there.

What happens if we outgrow the storage limit?

On Google Workspace Business Starter, storage is 30 GB per user pooled across the organization, so one heavy user eats into everyone's share. Microsoft 365 Business Basic gives each mailbox 100 GB. Either way the fix is a higher plan or archiving old mail.

Is our email backed up on Google Workspace or Microsoft 365?

Both replicate your data across data centers, so a disk failure will not lose it. Deletion is a different matter: a mailbox someone empties is recovered only within the plan's retention window. Set retention policies, and for mail you cannot afford to lose, add a third-party backup. Our cloud infrastructure team can set that up.

Can we keep our existing website hosting?

Yes. Website and email are separate services joined only by DNS records: one points web traffic at your web server, the MX record points mail at your mail provider.