The sixty-second answer
Register the domain in the business's own legal name, point an MX record at a mail host, create one mailbox for each person who sends email, add role addresses such as info@ and sales@ as aliases on top, then publish SPF so receivers can tell your mail from a forgery. In that order.
Why the order matters
Setting up business email is not difficult. It goes wrong because people start in the middle - they buy mailboxes first, or they let whoever built the website register the domain - and then discover that the foundation has to be replaced with the house already on it.
So here is the sequence, with what each step is actually for. It is the same sequence whether you are a sole operator or a company of twelve. In Canada that covers almost everyone: as of December 2024 there were 1.10 million employer businesses in the country, and 1.08 million of them - 98.2 per cent - were small businesses [1].
Step one: register the domain, in the business's name
The domain is the asset. Mailboxes, providers and website builders are all replaceable; the name your customers type is not.
Two rules. First, the registrant on file must be the business, not a contractor, not a friend who "handles the tech", and not an employee's personal account. Second, the registrar login and its contact address must live somewhere other than the domain you are registering - a personal address is fine for this one job. If the registrar's expiry warnings go to a mailbox on the expiring domain, you will not receive the warning that matters. That failure mode has its own article: what happens to your email when your domain expires.
If somebody else has already registered your domain on your behalf, the position is recoverable. Under ICANN's Transfer Policy, Registered Name Holders "must be able to transfer their domain name registrations between Registrars", and a Registrar of Record may refuse only in an enumerated list of circumstances - evidence of fraud, a genuine dispute over who the holder is, non-payment for a previous registration period, and a few timing rules [2]. Sort this out while the relationship is still friendly.
Step two: the MX record
An MX record is the sign that tells the rest of the internet where to deliver mail for your domain. Without it, nothing arrives, and senders are not left guessing - the standard requires the delivery name to resolve to MX or address records, and states that "if MX records are present, but none of them are usable, or the implicit MX is unusable, this situation MUST be reported as an error" [3].
Two practical consequences. Your website and your email are separate systems on the same name, so you can have working email with no website at all. And DNS changes propagate on a delay, so make this change before you print the address on anything.
Step three: one mailbox per person
Count the people who will send email as the business. That is your mailbox number. It is almost always smaller than the number of addresses you want, and the gap is where new businesses overspend.
A mailbox is storage with a login. An address is a label that routes to one. An alias is an address with no storage of its own: when a server expands an alias it "simply replaces the pseudo-mailbox address in the envelope with each of the expanded addresses in turn; the rest of the envelope and the message body are left unchanged" [3]. Nothing is stored twice and nothing extra is provisioned.
So a two-person business buys two mailboxes and can still publish six addresses. The arithmetic is worked through in how many email addresses your small business actually needs.
Pick the naming convention now, before anyone has a card printed. First name alone reads well and stays readable when you are three people; firstname.lastname survives growth and duplicate first names; initials survive nothing and confuse customers. Whichever you choose, apply it to everybody including the owner, because a mixed scheme is the thing people get wrong when they guess an address. And decide early whether the owner is going to answer info@ personally, because that decision quietly determines how much mail lands in one place.
Step four: role addresses
Role addresses are not decoration. There is a standard for them, and it lists the names people and machines will try without asking you first.
On the business side: INFO for general enquiries, SALES for purchase information, SUPPORT for problems with a product or service [4]. On the operations side: ABUSE, NOC and SECURITY [4]. And POSTMASTER, which the specification treats as required on any host running an SMTP server [4]. The standard's guidance is that organisations should support at least each mailbox name for which the corresponding function exists in the organisation [4] - so create the ones that match something you actually do, and skip the rest. Case does not matter; the names must be recognised independent of character case [4].
Point them at aliases to begin with. Convert one to a shared mailbox only when two people are working the same queue - the trade-off is set out in addresses, aliases and shared mailboxes.
Step five: publish SPF
Now make your mail hard to forge. Plain SMTP "places no restriction on what a sending host can use as the MAIL FROM of a message or the domain given on the SMTP HELO/EHLO commands" [5]. Anyone, anywhere, can claim to be you. SPF is the fix: a DNS record in which you "explicitly authorize the hosts that are allowed to use their domain names" [5]. A receiver that gets a "fail" has an explicit statement that the sender was not authorised, and may reject it outright with a 550 [5].
SPF is the first of three records. DKIM signs your messages and DMARC tells receivers what to do when the checks do not line up. Do SPF on day one and the other two within the first month - the walkthrough is SPF, DKIM and DMARC explained for small business. Skipping them is the single most common reason a new domain's mail lands in junk, which is its own article: why your business email goes to spam.
What attaches the moment you start sending
Two Canadian obligations begin with your first message, and neither is optional for small businesses.
CASL. Section 6(1) prohibits sending a commercial electronic message unless the recipient has consented - expressly or by implication - and the message complies with subsection 6(2) [6]. That subsection requires prescribed identifying information, a way to readily contact you, and an unsubscribe mechanism [6]. Contact information has to remain valid for a minimum of 60 days after the message is sent [6]. Build the compliant footer once, at setup: what your business email signature must include.
PIPEDA. Customer email is full of personal information, and Schedule 1 requires knowledge and consent for its collection, use and disclosure, and safeguards appropriate to its sensitivity "regardless of the format in which it is held" [7]. Openness is a principle too: your policies must be readily available to the people whose information you hold [7]. The practical version is business email privacy obligations in Canada.
The half-hour checklist
Domain registered to the business. Registrar contact on a different domain. Auto-renew on. MX record published. One mailbox per sender. Role aliases created and pointed at real people. SPF published. Mail configured on phone and laptop before you need it - see business email on your phone and laptop. A signature that satisfies CASL. That is the whole job.
Where we sit
MapleMail is Canadian-hosted business email on a domain you own. We will do this setup with you, and we will hand you the DNS records in writing rather than keeping them as a lever - the point of the arrangement is that your registrar and your mail provider are separable, so a disagreement with either never strands the business.
We do not quote plan prices in articles, because articles do not get updated when prices change; the current figures and what each mailbox includes are on the pricing page. What we will commit to here is the shape of the advice: buy seats for people, publish addresses for free, and put the domain in the business's name before you do anything else.