Contents6
When a password is forgotten, almost every company tool offers the same thing: a reset link sent by email. Email is therefore the tool that opens all the others, and the one that holds years of contracts, quotes and exchanges with customers. Choosing it deserves better than a reflex.
This guide from our Infrastructure and cloud section compares the three main options for a company of 20 to 500 people: Google Workspace, Microsoft 365 and European hosts. It names no winner: each answers different priorities, and the right one depends on yours.
In short
You are not choosing a mailbox but a suite: calendar, documents, video calls and directory come with it.
Microsoft and Google now offer to keep data in Europe, with conditions and limits worth reading.
European hosts answer the question of applicable law, with suites that are more or less complete.
Whatever the provider, domain authentication (SPF, DKIM, DMARC) decides whether your messages arrive.
The domain name remains yours: it is what lets you change provider without changing address.
What you are really choosing: a suite, not a mailbox
Google Workspace and Microsoft 365 sell far more than email: a shared calendar, a collaborative word processor and spreadsheet, video calls, file storage and the company’s account directory. Changing email often means changing all of that, along with the whole team’s habits.
European hosts cover a wider spectrum: some sell the mailbox alone, others a full suite with calendar, documents and video calls. Proton, Infomaniak, OVHcloud, mailbox.org or IONOS, among others, are compared on that scope before being compared on price.
The first question is therefore: what does your team use every day, besides email? A team that lives in shared spreadsheets and video calls does not weigh things up like a team that only uses the mailbox and the calendar.
Where the data lives, and which law applies
Two questions often get mixed up: where the data is stored, and which law can compel the provider to hand it over. The two big American providers have moved on the first.
- Microsoft announced on 26 February 2025 the completion of its “EU Data Boundary”: for its core services, including Microsoft 365, business customers’ data is stored and processed in the European Union and EFTA. Microsoft states that essential data may be transferred outside that area to respond to a global security incident.
- Google lets you choose a data region to store covered Workspace data in Europe. The option is not included in the Business Starter edition: it starts at Business Standard, and data processing is only covered in the most complete editions.
The second question, the law that applies to American providers wherever their servers are, is covered in our article on dependence on the American cloud. It is what pushes some companies towards a European host, especially when their customers require it by contract.
Key takeaway
Storing data in Europe and being subject to European law alone are two different guarantees. Ask yourself which one your customers, your contracts or your sector really require.
What gets your emails delivered: domain authentication
An email sent is not an email received. The major mail services check that the message really comes from a server authorised by your domain, and send to spam, or reject, whatever fails.
What the receiving mail service checks
- SPF
Is the sending server authorised by the domain?
- DKIM
Does the message carry a valid signature from the domain?
- DMARC
What to do with a message that fails these checks, and whom to report it to?
Since 1 February 2024, Google has set precise requirements for sending to a Gmail address:
senders must authenticate their domain with SPF or DKIM
messages a day to Gmail: above that, SPF, DKIM and DMARC are all required
reported spam rate not to be exceeded
These settings do not depend on the provider you choose: they are set in the domain name’s records, for email as for every tool that sends on your behalf (campaign software, CRM, invoicing, the website form).
From the field
On Palmora Property, a real estate portal we operate, the lesson learned fits in one sentence: without domain authentication, a strict DMARC policy destroys every campaign. You authenticate each sending tool first, then tighten. On our own website, every contact request is saved before the notification email is sent, by a sending service separate from our mailboxes: if sending fails, the request is still there.
For the campaigns themselves, our guide on how to run an email campaign goes through these settings step by step.
What about hosting your own email?
It is possible, with proven open source software, but it is the most demanding service to self-host. Google’s requirements are enough to show it: valid reverse DNS records, encrypted transmission, authentication, a monitored spam rate. You also need a good reputation for the server’s address, which is built slowly and lost quickly.
For most companies, the right split is clear: mailboxes at a provider, European or not, and the other tools (CRM, automation, analytics) on your own server when it makes sense. Our article on which tools to move out of SaaS first details that order of priority.
The criteria for choosing
- Scope
Mailbox only, or a full suite with calendar, documents and video calls.
- Data
Where it is stored, which law applies to the provider, what your customer contracts say.
- Administration
Two-factor authentication enforceable for everyone, an employee’s departure in one step, a sign-in log.
- Exit
Full export of mailboxes and documents, in a standard format, with no hidden fees.
- Price
Per user per month, with the commitment period and the options that push it up.
An employee’s departure deserves a real test before signing: disabling an account must cut off email, shared documents and the access that depends on them. Our guide to the team password manager completes that step for logins that do not go through email.
Email is part of the infrastructure foundation shared by your projects. The rest of the section covers neighbouring decisions: the five items that inflate a cloud bill, dedicated server, VPS or cloud, Kubernetes and mid-sized companies, monitoring, the disaster recovery plan, NIS2 in France, backing up your own server, self-hosted n8n in production, the three-year cost of leaving SaaS, cloud migration without breaking things, stolen API keys, the hardware to run an AI model yourself and managed or self-hosted Postgres.
For the tools that belong on your own server, alongside your email, see our Leaving SaaS offer. For an opinion on an email migration, describe your situation to us.
Frequently asked questions
Can we keep our email addresses when changing provider?
Yes, if the domain name is registered in the company’s name. Addresses depend on the domain, not on the provider: you create the mailboxes at the new one, import the history, then point the domain’s mail records to it. The switch is prepared so that no message is lost during the transition.
Does Microsoft 365 data stay in Europe?
For its core services, Microsoft has committed to storing and processing business customers’ data in the European Union and EFTA since completing its data boundary in February 2025. Microsoft provides for exceptions, notably to respond to a global security incident. The question of American law applying to the provider remains separate.
Are SPF, DKIM and DMARC mandatory?
To send to Gmail addresses, Google has required since February 2024 at least SPF or DKIM from all senders, and all three above 5,000 messages a day. Microsoft announced comparable requirements in April 2025 for high-volume senders to its consumer mail services. Even below these thresholds, these settings reduce the risk of a third party sending messages while impersonating you.
Should we host our email on our own server?
Rarely. It is the trickiest service to self-host: delivery depends on the server’s reputation, precise DNS settings and constant monitoring. Most companies are better off entrusting their mailboxes to a provider, European or not, and keeping their own server for the tools where self-hosting brings more.
Sources
- Microsoft, EU Data Boundary, February 2025 (new tab)blogs.microsoft.com
- Google Workspace, choose a geographic location for your data (new tab)knowledge.workspace.google.com
- Google, Email sender guidelines (new tab)support.google.com
- Microsoft, Outlook’s new requirements for high-volume senders, April 2025 (new tab)techcommunity.microsoft.com
Google Workspace, choose a geographic location for your data
Read on knowledge.workspace.google.com(new tab)Microsoft, Outlook’s new requirements for high-volume senders, April 2025
Read on techcommunity.microsoft.com(new tab)Jim · founder of Brain Plus AI
Also in infrastructure and cloud
Stepping back11 min
Sovereign cloud: can you do without the American giants?
European providers now hold only 15% of their own cloud market. Full sovereignty is out of reach; selective sovereignty starts with sorting your data and planning an exit.
Practical guide7 min
Self-hosting: which tools to move out of SaaS first
Not all subscriptions are equal when it comes to self-hosting: some open-source tools are mature and easy to run, others need a real team. Here is the order we recommend, and what stays on SaaS.
Practical guide7 min
Passwords: one password manager for the whole team
An "Access" spreadsheet, passwords sent over chat, a shared account nobody dares to change: a team password manager fixes all of it in one go. What it changes when someone joins or leaves, how to choose one, and where to start.