support@ on your own domain, without Google Workspace

The usual setup, and its cost#

A small SaaS needs support@, maybe hello@ and billing@, read by one or two people. The common answer is a Google Workspace or Microsoft 365 seat per person plus aliases or groups, and then a helpdesk on top when two people start answering the same thread. That is a lot of setup for three addresses.

With Mailbay, support@ is an inbox in your project. Anyone you invite can read and answer it in a shared inbox or in Apple Mail, replies go out as support@, and the same project sends your app's password resets from noreply@. Mailbay is free while the beta runs.

1. Paste your domain#

In the dashboard, choose New project and paste your domain. Mailbay looks it up live and tells you what it found:

• where your DNS is hosted (Vercel, Cloudflare, Route 53, GoDaddy, Namecheap or other),
• who receives your mail today (Google Workspace, Microsoft 365, Zoho, Fastmail, Proton, or another server),
• your existing SPF and DMARC records.

It then suggests addresses with a purpose each, which you can untick or rename: support@, hello@ and billing@ as inboxes, and noreply@ as a sender for app email that needs no inbox.

2. Keep the mail you already have#

If your domain already receives mail in Google Workspace, iCloud or anywhere else, Mailbay never moves it silently. It recommends a split:

• Receive on mail.acme.com. support@mail.acme.com lands in Mailbay. The root domain's MX records stay exactly as they are.
• Send from acme.com. Mailbay adds its DKIM key and merges its SPF include into your existing SPF record instead of replacing it, so noreply@acme.com is authenticated and Google or iCloud keep sending too. An existing DMARC policy is kept.

Prefer support@acme.com on the root? Choose the root option and move the domain's mail to Mailbay; the wizard warns you first. You can also choose sending only. Both options are explained in Domains that already receive mail.

3. Publish the records#

If your DNS is on Vercel or Cloudflare, Mailbay writes the records for you. Anywhere else you get a table to copy, and each record turns green as it goes live. For a Google Workspace domain the plan looks like this:

acme.com                     TXT    "v=spf1 include:_spf.google.com include:_spf.mailbay.dev ~all"
mb1._domainkey.acme.com      TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
bounce.acme.com              CNAME  bounce.mailbay.dev

mail.acme.com                MX 10  mx1.mailbay.dev
mail.acme.com                MX 20  mx2.mailbay.dev
mail.acme.com                TXT    "v=spf1 include:_spf.mailbay.dev ~all"
mb1._domainkey.mail.acme.com TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
_dmarc.mail.acme.com         TXT    "v=DMARC1; p=none; rua=mailto:dmarc@mailbay.dev"

What each of those records proves is in SPF, DKIM and DMARC explained with real records. One click setup through Domain Connect, for hosts like GoDaddy and IONOS, is coming soon. Once the records are in, send one message to the email deliverability test to confirm SPF, DKIM and DMARC pass for real mail.

4. Answer from the support inbox#

The dashboard's Inbox shows every conversation across your projects and inboxes, with filters for open, assigned to me, unassigned, closed and snoozed. Replies are sent as support@ and threaded with the right In-Reply-To and References headers, so they stay in one conversation in the customer's Gmail or Outlook. A new message on a closed conversation reopens it. It is keyboard first:

Want a copy in your personal inbox too? Add a forward on the inbox. The target confirms it by email, and the copy's Reply-To is support@, so answering from Gmail still lands in the shared conversation.

5. Or use Apple Mail and Outlook#

On the inbox page, create an app password. It is shown once, belongs to you, and is revoked automatically if you lose access to the inbox. Then add an account in any mail app:

Username        support@mail.acme.com
Password        the app password (abcd-efgh-ijkl-mnop)
Incoming, IMAP  imap.mailbay.dev   port 993   SSL/TLS
Outgoing, SMTP  smtp.mailbay.dev   port 465   SSL/TLS   (or 587, STARTTLS)

You get Inbox, Sent, Archive, Junk and Trash folders. Marking a message read in the app marks the conversation read for you, and archiving it closes the conversation. On a Mac or iPhone you can download a configuration profile from the inbox page instead of typing these in.

6. Bring in a teammate#

Invite people by email under Settings, Members. For someone who only handles support, choose the workspace role Member and the project role Support, limited to the inboxes they should see:

Workspace role   Member
Project          Superchat
Project role     Support
Inboxes          support@mail.acme.com, billing@mail.acme.com

They can read and reply in those two inboxes, assign and close conversations, and nothing else: no other projects, no API keys, no domains, no billing. Every change to members, keys and domains goes into the audit log.

Running support for several products or clients? See Mailbay for indie hackers and Mailbay for agencies and freelancers.