Business email hosting is a paid service that runs mailboxes on your own domain (name@yourcompany.com) with spam filtering, security controls, storage and support. In 2026, most companies in Jordan and the GCC choose between Microsoft 365 (from about USD 4 to 7 per user per month for email-focused plans), Google Workspace (from about USD 7) and hosted mail bundled with web hosting, which costs least but offers fewer features. Whichever you choose, publish SPF, DKIM and DMARC records, because Gmail, Yahoo and Outlook.com now enforce them for bulk senders.
What is business email hosting?#
Business email hosting is the service that stores your company’s mailboxes, receives mail addressed to your domain and sends mail on its behalf. A complete service includes:
- Mailboxes on your domain, with webmail, desktop and mobile apps.
- Spam, phishing and malware filtering on incoming and outgoing mail.
- An admin console to manage users, enforce MFA and remove access when staff leave.
- Storage, archiving and support from the provider.
A free personal Gmail or Outlook.com address may work for a sole trader, but it weakens trust with customers, and the company does not control the account when an employee leaves.
Microsoft 365 vs Google Workspace vs hosted mail#
Microsoft 365 runs email on Exchange Online and works best with Outlook. According to Office Watch, Microsoft raised business prices on 1 July 2026: Business Basic went from USD 6 to 7 per user per month, Business Standard from USD 12.50 to 14, and Business Premium stayed at USD 22. Urban IT lists Exchange Online Plan 1, an email-only plan, at USD 4 per user per month with a 50 GB mailbox.
Google Workspace runs email in Gmail. Google’s pricing page lists Business Starter at USD 7, Business Standard at USD 14 and Business Plus at USD 22 per user per month, with 30 GB, 2 TB and 5 TB of pooled storage per user respectively. Google regularly offers new-customer discounts, so check the terms at checkout.
Hosted mail means mailboxes on a web-hosting control panel such as cPanel or Plesk, or an email-only provider. Hosting mail is often bundled with a website plan, and Capterra lists Zoho Mail Lite at USD 1 and Mail Premium at USD 4 per user per month.
| Option | Typical list price per user/month (USD, 2026) | Mailbox storage | Best for | Watch out for |
|---|---|---|---|---|
| Microsoft 365 / Exchange Online | 4 (Exchange Plan 1) to 22 (Business Premium) | 50 GB on Exchange Plan 1 and Business Basic | Outlook, Office desktop apps and Teams users | SMTP AUTH changes for devices; licence tiers |
| Google Workspace | 7 (Starter) to 22 (Plus) | 30 GB to 5 TB pooled | Browser-first teams using Docs and Meet | Data regions limited to US or Europe |
| Hosted mail (cPanel, Plesk, Zoho) | Bundled with hosting, or from 1 | Varies by plan | Small teams with simple needs and tight budgets | Weaker filtering, archiving and support on some plans |
These are typical market ranges from the sources named above. Local prices in Jordan and the GCC vary with currency, reseller and tax, and annual commitments usually cost less than flexible monthly billing: Dupple notes that Google’s flexible plan runs 20% above the annual rate.
Which option fits your company?#
- Choose Microsoft 365 if your team lives in Outlook and Excel, uses Teams, or needs Windows device management and Microsoft security tools.
- Choose Google Workspace if your team works in the browser, shares Docs and Sheets, and wants simple administration.
- Choose hosted mail for a handful of mailboxes with modest storage needs, and accept fewer compliance and collaboration features.
Data location and the law in Jordan and the GCC#
Data location is the country where your mailboxes are stored at rest. Microsoft’s documentation lists the United Arab Emirates and Qatar among the local-region geographies for its Advanced Data Residency add-on; Saudi Arabia is not on that list. Google’s documentation says Workspace data regions cover the United States or Europe only, and Business Starter is not eligible.
Email holds personal data, so the law matters. Jordan’s Personal Data Protection Law No. 24 of 2023 took effect on 17 March 2024, according to Clyde & Co, and Saudi Arabia’s PDPL has been fully enforceable by SDAIA since 14 September 2024. Both regulate personal data and cross-border transfers, so confirm the position for your sector with legal counsel before you commit.
Arabic and everyday use#
Outlook and Gmail both offer Arabic interfaces and right-to-left composing, so bilingual teams can write in Arabic and English. Many teams in the region coordinate on WhatsApp, but email remains the record for quotes, contracts and invoices, so deliverability matters.
Custom domain setup: the DNS records you need#
Your domain’s DNS tells the world where to deliver your mail and which servers may send it. Every business email setup needs these records:
| Record | What it does | Example |
|---|---|---|
| MX | Tells other servers where to deliver mail for your domain | Points to your provider’s mail servers |
| SPF (TXT) | Lists the servers allowed to send as your domain | v=spf1 include:spf.protection.outlook.com -all |
| DKIM (TXT or CNAME) | Publishes the public key that verifies your digital signature | selector1._domainkey for Microsoft 365, google._domainkey for Google |
| DMARC (TXT) | Tells receivers what to do when SPF or DKIM fails, and where to send reports | v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com |
Publish only one SPF record per domain, and include every service that sends as your domain: website contact forms, CRM, invoicing software and newsletter tools. SPF allows a maximum of 10 DNS lookups, so remove services you no longer use.
SPF, DKIM, DMARC and the bulk-sender rules#
SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send mail for your domain. DKIM (DomainKeys Identified Mail) is a cryptographic signature that proves a message was not altered and came from your domain. DMARC (Domain-based Message Authentication, Reporting and Conformance) is a policy that ties both to the visible From address and tells receivers whether to accept, quarantine or reject failing mail.
The big mailbox providers now require them:
- Google: since 1 February 2024, all senders to Gmail need SPF or DKIM, valid forward and reverse DNS, TLS and a spam rate below 0.3%. Bulk senders of more than 5,000 messages a day also need SPF, DKIM, a DMARC policy of at least p=none, From-domain alignment and one-click unsubscribe for marketing mail. Google recommends 2048-bit DKIM keys.
- Gmail enforcement: according to Red Sift, Gmail ramped up enforcement in November 2025, slowing non-compliant mail with temporary errors and rejecting some outright.
- Yahoo: its sender best practices require SPF, DKIM and a passing DMARC policy of at least p=none, one-click unsubscribe, and honouring unsubscribes within 2 days.
- Microsoft Outlook.com: according to Mailgun, from 5 May 2025 Microsoft began rejecting mail from senders of more than 5,000 messages a day that fail these checks, with the error 550 5.7.515.
A sensible DMARC roadmap is to start at p=none with reporting, fix every legitimate sender that fails, then move to p=quarantine and finally p=reject. Even if you never send 5,000 messages a day, this protects your domain from spoofing and helps your invoices reach the inbox.
Migrating email without losing messages#
- Inventory mailboxes, aliases, sizes and every app or device that sends mail.
- Lower DNS TTLs a day or two before cutover.
- Create users on the new platform with MFA from day one.
- Copy existing mail using the provider’s tools, such as IMAP migration in the Exchange admin center or Google’s data migration service.
- Switch MX, SPF and DKIM records, then run a final sync to catch late messages.
- Reconnect phones and Outlook profiles, and keep the old service for a short overlap period.
Check devices before you move. According to Office 365 for IT Pros, Microsoft will turn off Basic authentication for SMTP AUTH by default at the end of December 2026 and announce a final removal date in the second half of 2027, which affects scanners, printers and older apps that send mail with a password.
Security essentials for business email#
Email is a main entry point for attackers. Verizon’s 2025 DBIR SMB snapshot found that system intrusion, social engineering and basic web application attacks make up 96% of breaches at small and medium-sized businesses. Protect your mail with:
- Multi-factor authentication for every mailbox.
- Separate admin accounts not used for daily mail.
- A DMARC policy that moves to quarantine or reject.
- Phishing awareness, especially about fake payment-change requests.
How Consult One helps#
Consult One is a digital and IT agency based in Amman, Jordan, working with companies in Jordan, the GCC and the USA since 2004. Our mail and web hosting service covers business email selection, licensing, DNS records, SPF, DKIM and DMARC setup, and migration, as part of our wider IT services. We keep domains, licences and admin access in your company’s name.
Not sure whether Microsoft 365, Google Workspace or hosted mail fits your team, or why your emails land in spam? Tell us your mailbox count and current setup, and we will recommend a platform and a deliverability plan. Get a free quote.
FAQ#
What is the cheapest business email hosting?
The cheapest business email hosting is usually mail included with your web hosting plan, or an email-only service such as Zoho Mail Lite, which Capterra lists at USD 1 per user per month. Microsoft’s Exchange Online Plan 1 is listed at about USD 4 with a 50 GB mailbox. Cheaper plans often trade away storage, archiving, support and advanced security, so compare features as well as price.
Is Microsoft 365 or Google Workspace better for business email?
Neither is better for everyone. Microsoft 365 suits companies that rely on Outlook, desktop Word and Excel, Teams and Windows device management. Google Workspace suits browser-first teams that collaborate in Gmail, Docs and Meet. Both run email on your own domain and support SPF, DKIM and DMARC. In 2026 their entry and mid-tier list prices are similar, so choose on workflow, security and data-location needs.
Do small companies really need SPF, DKIM and DMARC?
Yes. Google’s sender guidelines require every sender to Gmail to use SPF or DKIM, and bulk senders of more than 5,000 messages a day must use SPF, DKIM and DMARC. Yahoo and Microsoft’s Outlook.com apply similar rules. Even a small company benefits, because these records help invoices and quotes reach the inbox and make it much harder for criminals to spoof your domain.
Can I keep my email address if I change email provider?
Yes. Your email address belongs to your domain, not to the provider, so you can move from hosted mail to Microsoft 365 or Google Workspace and keep name@yourcompany.com. You create the same mailboxes on the new platform, copy existing mail across, then update the MX, SPF and DKIM records in DNS. Planned properly, staff keep their addresses and their mail history.
Where is business email data stored for companies in the GCC?
It depends on the provider and plan. Microsoft’s Advanced Data Residency add-on lists the United Arab Emirates and Qatar among its local-region geographies, while Saudi Arabia is not on that list, according to Microsoft’s documentation. Google Workspace data regions offer the United States or Europe only, and not on Business Starter. Check your sector’s rules and Jordan’s or Saudi Arabia’s data-protection law before choosing.
