Who Owns Your Business Email When Someone Quits?

Your office manager of six years gives two weeks' notice. Good terms. Cake on the last day, hugs all around.

Three weeks later a supplier calls asking why nobody answered their last two quotes. You go looking and find out the quotes have been going to an address like yourcompany.office@gmail.com, which got set up years ago because it was quick and easy. The supplier portal login is tied to that address. So is the shipping account. So, it turns out, is the owner login for your Google Business Profile.

Nobody did anything wrong here. Nobody stole anything, and your former office manager would happily help if you asked. But the password and the recovery phone number belong to them, which means the account belongs to them. Your business has been borrowing it the whole time.

This is one of the most common things I find when taking stock of a small business's setup. It almost never gets noticed until the day someone leaves.

A free email address belongs to a person, not a business

Gmail, Yahoo, Outlook.com, AOL. These are personal accounts. Google or Microsoft has a relationship with whoever created the account and controls the recovery phone, and with nobody else. There is no company administrator who can step in and take it over. If the person holding it moves away, changes their number, or simply stops answering, the account and everything tied to it walks out the door with them.

And everything tied to it is usually a longer list than you think. Email is the master key to the rest of the internet. Every "forgot password" link goes to an inbox, so whoever controls the inbox controls the accounts behind it.

There is a smaller version of the same problem that is even more common: one shared info@ address on a free account, with a password that five current employees and two former ones all know.

What email on your own domain actually buys you

Moving to an address like you@yourcompany.com through Microsoft 365 or Google Workspace does make you look more established. That is the minor benefit. The real one is that the business holds the keys.

• The business is the administrator. You, or whoever you designate, can reset any password, lock any account, and see every mailbox that exists. Nobody has to be asked for a favor.
• Accounts outlive the people in them. When someone leaves, their mail, files, and calendar stay with the company.
• Shared jobs get shared inboxes. Addresses like info@ and orders@ become shared mailboxes that several people can see, instead of one login everybody knows.
• Security you can actually enforce. Multi-factor sign-in gets turned on for everyone from one admin screen, instead of hoping each person did it themselves.

For most small businesses this runs well under $20 per person per month, and often under half that, depending on the plan. It is one of the cheapest pieces of insurance a business can buy.

Microsoft 365 or Google Workspace

The honest answer is that both are good, and the right one depends on how your team already works.

If your team lives in Word, Excel, and Outlook, or you trade files with clients and vendors who do, Microsoft 365 usually fits better. If your team works mostly in a browser and you want administration that is a little simpler, Google Workspace often wins. My own business runs on both Google Workspace and Microsoft 365, and I set up and support both for clients, so the advice comes from how you work, not from which one somebody happens to sell.

The only wrong answer is staying on a free account because switching sounds scary. A planned move brings your mail, calendars, and contacts across, and the old and new systems run side by side during the cutover so nothing falls through the gap.

Why your email lands in spam

In February 2024, Gmail and Yahoo started requiring senders to prove their mail is really theirs. Microsoft followed for Outlook.com in May 2025. The strictest rules target businesses sending thousands of emails a day, but spam filters everywhere now lean on the same three records attached to your domain:

• SPF is the list of services allowed to send email as your domain. It most often breaks when you add a newsletter tool, invoicing software, or a website contact form that sends mail as you, and nobody adds it to the list.
• DKIM is a digital signature that proves a message really came from an approved sender and was not changed on the way.
• DMARC tells receiving servers what to do with mail that fails the first two checks, and sends you reports about who is sending as your domain. You start it in monitor-only mode and tighten it once you know everything legitimate passes.

A free Gmail address cannot carry any of this for your company. And a quote from yourcompany.quotes@gmail.com looks a lot like the fake invoices that land in inboxes every day, both to a spam filter and to a careful customer.

These records are not the whole story. Wording, links, and attachments can still trip filters even when every record passes. But they are the first thing to check, and the most common reason a business's mail quietly goes missing. If your website's contact form sends you leads by email, the same rules apply to it. I covered that in Nothing Changed on Your Website. Everything Changed Around It.

The offboarding checklist

Do this on the person's last day, not three weeks later when a supplier calls.

1. Reset their password and sign them out everywhere. Both platforms let you do this from the admin screen in under a minute, including on their phone.
2. Keep the mailbox, drop the license. In Microsoft 365, convert their mailbox to a shared mailbox, which in most cases does not need a paid license, and give access to whoever is picking up their work. In Google Workspace, export or move any mail you need to keep, transfer their files to someone else, and add their address as an alias on a current employee's account so customer mail still lands somewhere.
3. Transfer ownership of shared files and folders they created, so nothing disappears with their account.
4. Walk the list of outside accounts. Bank and payroll access, supplier portals, your domain registrar, website hosting, your Facebook page, and your Google Business Profile. Remove their access or change the password, and move anything tied to a personal address over to a business one.
5. Collect the hardware, and make sure company mail and files are removed from any personal phone or laptop they used.
6. Write down what you did. The next time takes half as long.

The first two steps take about ten minutes. Step four takes longer the first time, because that is where you find out what is tied to whom. That is exactly why it is worth doing before anyone leaves.

Paying for people who left in 2024

While you are in there, count your licenses and count your people. The two numbers rarely match. The usual findings are licenses still billing for people who left, top-tier plans for people who only use email, and a business paying for Microsoft and Google at the same time because a switch was started and never finished.

That money comes back every month once it is cleaned up.

Where to start

If you do one thing this week, make a list of every account that matters to the business: bank, payroll, Google Business Profile, domain, website hosting, social pages, and your top few suppliers. Next to each one, write down which email address it is tied to.

Any line that ends in gmail.com, yahoo.com, or a former employee's name is your fix list.

If that list is longer than you would like, or you are stuck deciding between Microsoft and Google, that is exactly what my business email setup covers, from choosing a platform to moving your mail to fixing the records that keep it out of spam. If email is one piece of a bigger tangle, IT support starts with writing down what you have and where it lives. Either way, reach out and we will look at your setup together. If it turns out to be in good shape, I will tell you that too.