Cloud Email Services: How They Work and How to Choose One

What are cloud email services?

Cloud email services are email systems hosted and operated by a provider on its own infrastructure and delivered over the internet. The provider runs the mail servers, storage, spam filtering, and security; you manage users, settings, and your domain's DNS records, and you pay by subscription or usage.

The term covers two different jobs, and many searches for cloud email services mix them up:

• Mailbox hosting gives people inboxes, calendars, and contacts on your own domain, used through Outlook, Gmail, mobile apps, or a browser. Microsoft 365 (Exchange Online) and Google Workspace (Gmail) are the best-known examples.
• Email sending services let applications send messages such as password resets, receipts, notifications, and newsletters through an API or SMTP. Amazon Simple Email Service (Amazon SES) is a cloud-provider example; several specialist platforms also exist.

A third group, cloud email security, filtering, archiving, and backup services, sits alongside both.

In cloud computing terms, business email is a classic example of Software as a Service (SaaS). Our cloud remote servers guide places email in the wider picture of cloud communication and collaboration tools.

How cloud email works

Cloud email relies on DNS records that point your domain to the provider. When someone sends you a message, their server looks up your domain's MX record and delivers the message to the provider over SMTP. Your users then read it through apps that connect to the provider over secure protocols or APIs.

1. SendingA sender's mail server looks up the MX (mail exchanger) record for your domain to find where to deliver.
2. DeliveryThe message travels over SMTP, ideally encrypted with TLS, to the provider's inbound servers.
3. ChecksThe provider verifies authentication (SPF, DKIM, DMARC) and scans for spam, malware, and phishing.
4. StorageAccepted messages are stored in the user's mailbox in the provider's data centers, usually with redundancy across locations.
5. AccessUsers read mail through web apps, desktop and mobile clients, or protocols such as IMAP, Exchange ActiveSync, or the provider's own APIs.

DNS records every cloud email setup uses

Scroll the table sideways to see all columns.

Types of cloud email services

The main types of cloud email services are business mailbox suites, hosted or private email servers, transactional email platforms, marketing email platforms, email security services, and email archiving and backup services. Most organizations use a mailbox suite plus one or more of the others.

Scroll the table sideways to see all columns.

Business mailbox suites

Mailbox suites are what most people mean by cloud email. Beyond mailboxes, they bundle calendars, contacts, shared mailboxes, mobile device management, and usually documents, chat, and video meetings. That bundling is why the choice of email provider often decides an organization's wider collaboration platform. It also connects email to other communication tools such as a cloud based video conferencing service.

Hosted and self-managed email servers

Some providers still host dedicated mail servers, such as Exchange, for individual customers, and some organizations run their own mail servers on cloud virtual machines. This offers control over configuration and data location, but it brings back patching, spam filtering, and IP reputation work that SaaS providers handle at scale. Hosted Exchange has also become rarer; Rackspace, for example, shut down its Hosted Exchange service after a ransomware incident in December 2022.

Transactional email platforms

Applications should not send large volumes of automated mail through staff mailboxes. Transactional platforms provide APIs, SMTP relays, dedicated or shared sending IP addresses, bounce and complaint handling, and delivery analytics. They typically charge by message volume. Use a separate subdomain (for example, mail.example.com) for application mail so its reputation stays separate from your staff email.

Marketing email platforms

Marketing platforms add list management, templates, segmentation, and consent tracking. In the United States, commercial email must follow the CAN-SPAM Act, which requires a working opt-out and accurate sender information, and large mailbox providers now require one-click unsubscribe for bulk senders.

Email security, archiving, and backup

These services are covered in the security and compliance sections below.

Cloud email vs. on-premises email servers

Cloud email moves server maintenance, spam filtering, storage, and availability to the provider in exchange for a recurring fee and less direct control. On-premises email gives full control but requires hardware, patching, security expertise, and careful management of sending reputation.

Scroll the table sideways to see all columns.

For organizations still running Microsoft Exchange Server, the timeline matters. Microsoft ended support for Exchange Server 2016 and Exchange Server 2019 on October 14, 2025, which means no further security updates under standard support. Microsoft's on-premises successor is Exchange Server Subscription Edition (SE), released in July 2025. The alternative is moving mailboxes to a cloud email service such as Exchange Online, or a hybrid setup during the transition.

Common cloud email service providers

For business mailboxes, Microsoft 365 and Google Workspace are the most widely used cloud email services, with Zoho and privacy-focused providers such as Proton as common alternatives. For application sending, Amazon SES and specialist platforms such as SendGrid, Mailgun, and Postmark are widely used.

Microsoft 365 (Exchange Online)

Built on Exchange, with Outlook as the main client. Strong fit for organizations using Windows, Office apps, Teams, and Microsoft Entra ID for identity. Advanced security, compliance, and archiving features depend on the plan.

Google Workspace (Gmail)

Browser-first email with Google Docs, Drive, Meet, and Chat. Popular with startups, schools, and organizations that work mainly in the browser. Security and data governance features also vary by edition.

Zoho Mail and Zoho Workplace

A lower-cost suite often chosen by small businesses, with close ties to Zoho's CRM and business apps.

Privacy-focused providers

Providers such as Proton Mail and Tuta emphasize end-to-end encryption and minimal data collection. Encryption between users of the same service is simple; encrypted mail to outside recipients usually requires a password-protected message or a standard such as PGP.

Sending platforms

Amazon SES suits teams already on AWS that want low-level control. Specialist platforms add richer dashboards, templates, and deliverability support. Compare them on API quality, deliverability tools, dedicated IP options, data retention, and support.

Plans, prices, and feature sets change frequently. Check each provider's current plan comparison for the specific features you need, such as archiving, data loss prevention, or advanced threat protection, since these are often limited to higher tiers.

Email authentication and deliverability

Email authentication proves that mail using your domain really comes from you. SPF, DKIM, and DMARC are the three core standards, and major mailbox providers now require them for bulk senders. Setting them up correctly is part of every cloud email service deployment, not an optional extra.

SPF, DKIM, and DMARC

• SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send mail for your domain. It has a limit of 10 DNS lookups, which organizations using several cloud email services can hit quickly.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. Every service that sends as your domain, including your mailbox provider and any sending platforms, should sign with DKIM for your domain.
• DMARC ties SPF and DKIM to the visible From address, tells receivers what to do when checks fail (none, quarantine, or reject), and sends you reports. Start with p=none to collect reports, fix every legitimate sender, then move to quarantine and reject.

Bulk sender requirements

Scroll the table sideways to see all columns.

Even below these thresholds, authenticated mail is more likely to reach the inbox. Federal agencies have been required to use DMARC with a reject policy since CISA's Binding Operational Directive 18-01, which is a useful benchmark for any organization.

Other standards worth knowing

MTA-STS tells sending servers they must use encrypted TLS connections when delivering to your domain, and TLS-RPT sends reports when that fails. BIMI lets participating mailbox providers display your logo next to authenticated messages; it requires DMARC at enforcement and, at some providers, a verified mark certificate.

Deliverability basics

• Send application and marketing mail from separate subdomains so problems in one do not affect staff email.
• Remove bounced addresses and honor unsubscribes promptly.
• Warm up new sending IPs or domains gradually rather than sending large volumes on day one.
• Monitor provider tools such as Google Postmaster Tools and review DMARC reports regularly.

Cloud email security

Securing cloud email means protecting accounts, filtering malicious messages, and preventing impersonation. The provider secures its infrastructure, but account security, configuration, and user behavior remain your responsibility under the cloud shared responsibility model.

The main threats

• Phishing tricks users into revealing credentials or opening malware.
• Business email compromise (BEC) uses a compromised or look-alike account to request payments or sensitive data. The FBI's Internet Crime Complaint Center (IC3) consistently ranks BEC among the most financially damaging forms of cybercrime reported to it.
• Account takeover happens when stolen passwords are used against webmail or legacy protocols.
• Domain spoofing sends mail that appears to come from your domain, which DMARC at enforcement blocks.

Essential controls

• Multi-factor authentication on every mailbox, with phishing-resistant methods such as passkeys or security keys for administrators and finance staff.
• Disable legacy authentication. Protocols that send passwords directly (basic authentication) bypass MFA. Microsoft has disabled basic authentication for most Exchange Online protocols and has announced the retirement of basic authentication for SMTP AUTH client submission; check its current timeline if you have printers, scanners, or applications that send mail this way.
• Filtering for spam, malware, and impersonation, including warnings for external senders and look-alike domains.
• Mail forwarding rules monitored or restricted, since attackers often create hidden rules after taking over an account.
• Data loss prevention policies to catch sensitive data being emailed outside the organization.
• Encryption in transit (TLS, reinforced by MTA-STS) and message encryption for sensitive content.
• User training on recognizing phishing and verifying payment requests by phone.

Built-in filtering vs. added email security

Microsoft 365 and Google Workspace include substantial filtering, and many organizations rely on it alone. Others add a third-party service, either a secure email gateway that sits in front of the mailbox by changing MX records, or an API-based tool that connects directly to the mailbox and can remove messages after delivery. The cloud security section of our main guide explains the broader shared responsibility model.

Compliance, retention, and backup

Cloud email services offer retention policies, legal holds, and eDiscovery search, but these are compliance tools, not independent backups. Organizations in regulated industries also need the right contracts, such as a HIPAA business associate agreement, and plan-level features that meet their record-keeping rules.

Regulations and contracts

Healthcare organizations that email protected health information need a business associate agreement (BAA) with their cloud email provider; Microsoft and Google offer BAAs for eligible plans, and HHS has published guidance on HIPAA and cloud computing. Financial firms may face record-retention rules from the SEC or FINRA. Government contractors may need services that meet specific federal requirements. Confirm the exact plan and configuration required, not just that the provider "supports" a regulation.

Retention and eDiscovery

Retention policies keep messages for a set period even if users delete them, and legal holds preserve mailboxes during litigation. eDiscovery tools search across mailboxes and export results. These capabilities often depend on the subscription tier.

Backup

Cloud email providers protect against their own hardware failures, but a deleted mailbox, a malicious insider, a ransomware-encrypted sync, or a misconfigured retention policy can still cause data loss. Providers generally expect customers to manage their own recovery needs. Options include third-party backup services and Microsoft 365 Backup, Microsoft's own backup offering. Test restores the same way you would for servers.

How to choose a cloud email service

Choose a cloud email service by starting with how your team works: the office apps and identity system you already use, your security and compliance requirements, the features you need at each plan level, and whether you also need a separate service for application or marketing email.

Scroll the table sideways to see all columns.

Evaluation checklist

• Mailbox size and archive limits per plan, and what happens when users exceed them.
• Identity integration: single sign-on, MFA options, and conditional access.
• Security features included at your plan level: phishing protection, DLP, encryption, audit logs.
• Compliance: retention, eDiscovery, legal hold, BAA availability, and data residency options.
• Client support: desktop, mobile, and web apps your users prefer, plus IMAP or API access for integrations.
• Availability: the published SLA and the provider's status history.
• Migration tools for your current system.
• Admin experience: user management, shared mailboxes, groups, and reporting.
• Total cost including add-ons for security, archiving, and backup.

Migrating to cloud email services

Moving to a cloud email service involves preparing DNS and accounts, copying existing mail, switching your MX records, and then fixing authentication and client settings. Most of the risk is in planning: missed senders, forgotten shared mailboxes, and devices that still use old settings.

1. InventoryList mailboxes, shared mailboxes, aliases, distribution lists, forwarding rules, and every system that sends mail as your domain (websites, CRM, printers, applications).
2. Lower DNS TTLsA day or more before cutover, reduce the time-to-live on MX and related records so the change takes effect quickly.
3. Set up the new serviceVerify your domain, create users and groups, and configure security settings and MFA.
4. Copy existing mailUse the provider's migration tools (for example, IMAP, cutover, staged, or hybrid migration for Exchange, or Google's migration tools) to copy mail, calendars, and contacts. Large mailboxes can take days, so start early.
5. Switch MX recordsPoint MX to the new provider and run a final synchronization of any mail that arrived during the switch.
6. Update authenticationUpdate SPF, enable DKIM signing on the new provider, and review DMARC reports for senders you missed.
7. Reconfigure clients and devicesHelp users set up apps and phones, and move scanners and applications to supported sending methods.
8. Decommission carefullyKeep the old system available read-only for a period, confirm archives and backups, then shut it down.

For the general cloud migration process, see the cloud migration section of our main guide.

Cost considerations for cloud email services

Business cloud email services are usually priced per user per month, with higher tiers adding security, compliance, and storage. Sending platforms usually charge by message volume. The total cost often depends more on add-ons and plan choices than on the base mailbox price.

Prices change often, so this guide does not quote them. Factors to compare include:

• The plan tier each user needs, since not every user needs the most expensive license
• Shared mailboxes and resource accounts, which are often free or cheaper than user licenses
• Security add-ons such as advanced threat protection or a third-party email security service
• Archiving, eDiscovery, and backup services
• Sending volume, dedicated IP addresses, and data retention on transactional platforms
• Annual vs. monthly commitments, and nonprofit or education pricing where eligible
• One-time migration effort, whether internal or outsourced

Getting outside help with cloud email

Many small and mid-size organizations use an IT provider or cloud specialist for email migrations, DNS and authentication setup, security hardening, and ongoing administration. It is one of the most common starting points for outside cloud help.

Typical engagements include migrating from an older server or another provider, setting up SPF, DKIM, and DMARC to enforcement, configuring security policies, and ongoing user management through a managed service. Some providers also bundle managed cloud security services for email monitoring and response. Our guide to cloud tech services explains provider types, pricing models, contracts, and how to evaluate a provider.

Cloud email services FAQs

Related guides