You can manage a domain’s DNS with one provider and host its email with another. They are separate services connected by DNS records, not one service just because they appear under the same login. Choose a setup based on whether you need forwarding or full mailboxes, how you want to manage accounts and recovery, and how much migration work you can handle.
First, separate domain registration, DNS, and email
These are related but distinct jobs. A registrar manages the domain registration; a DNS provider publishes records for the domain; and a mail provider hosts mailboxes or handles forwarding. A single company may offer more than one of these services, but a shared dashboard does not make their technical roles interchangeable.
As an Amazon Associate I earn from qualifying purchases.
- DNS hosting: Publishes records that tell other systems where services for your domain are located.
- Mailbox hosting: Stores and handles email for users at your domain. MX records direct incoming mail to the mail service.
- Email forwarding: Sends incoming messages onward to another address. It is not necessarily a mailbox and may not support sending mail from your domain.
For example, Cloudflare documents using its DNS with Google Workspace, Microsoft 365, or Zoho Mail. Each mail provider supplies its own DNS configuration, which you add at the DNS provider. Cloudflare’s Google Workspace setup guide, Microsoft’s DNS setup instructions, and Zoho’s domain-verification guide describe this kind of arrangement.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Decide whether forwarding is enough or you need mailboxes
Receiving-only forwarding
Cloudflare describes Email Routing as a receiving-only forwarding service. It routes incoming messages to another address; it is not a complete hosted mailbox for sending and receiving. Cloudflare says sending and receiving email for a domain requires an SMTP provider and the DNS records that provider specifies. Cloudflare Email Routing documentation
#1 Best Overall
Full hosted email
If people need mailboxes at your domain, choose a mailbox provider such as Google Workspace, Microsoft 365, or Zoho Mail, then configure the provider’s records wherever the domain’s DNS is hosted. A forwarding service and a hosted mailbox can have conflicting requirements: Cloudflare says its Email Routing and Google Workspace MX records cannot coexist on the same domain because both require control of MX records. Decide which service should receive mail before changing MX records.
What changes when DNS and email use separate vendors?
Using separate providers is a documented, supported configuration. It can give you a choice of DNS host and mail service independently, but it means you must manage the relationship between them: verify domain ownership, publish the correct records, and maintain access to both accounts.
- Records are provider-specific. Google Workspace’s Cloudflare instructions cover ownership verification, MX, SPF, DKIM, and DMARC. Microsoft and Zoho provide their own setup values and workflows.
- Automation varies. Microsoft supports Domain Connect automation as well as manual DNS setup for Cloudflare. Zoho supports TXT, CNAME, HTML, or one-click verification with selected providers; the administrator must be able to edit the domain’s DNS.
- MX values must match the intended mail provider. Zoho’s MX values vary by data center, so use the values shown in the Zoho account rather than a generic example. Zoho email-delivery setup
- Proxy settings matter. Cloudflare says MX records cannot be proxied. Email-only A or AAAA records should be DNS-only; proxying email traffic can direct connections to Cloudflare instead of the mail server and prevent delivery. Cloudflare proxy-status use cases
Microsoft says DNS changes typically take about 15 minutes but can take longer. Treat that as an expectation, not a guaranteed deadline. Microsoft DNS setup guidance
Choose a setup by the work you need it to do
| Question | What to evaluate |
|---|---|
| Do you need forwarding or full mailboxes? | Forwarding can handle incoming mail to another address; a hosted mailbox is the relevant option for full send-and-receive service. |
| How many accounts and consoles are acceptable? | A bundled dashboard may reduce the number of places you visit. Separate vendors require access to each account and coordination of DNS with mail settings. |
| Who controls sign-in recovery? | Check MFA options, recovery methods, and who can access the email or phone number used to recover each account. |
| How much setup automation is available? | Check whether your DNS host and mail provider support a guided connection or whether you will enter records manually. |
| Could you move mail later? | Plan for mailbox creation, DNS cutover, and any migration of existing messages before changing MX records. |
| How much dependency on one account is acceptable? | Consider what happens if the account controlling several services is inaccessible, and whether you can recover each service independently. |
| What is the total cost for your needs? | Compare current plans and required features directly. The available setup documentation does not establish a universal price advantage for bundled or separate providers. |
There is no established universal winner on security, price, reliability, or administrative effort. The official configuration material explains how the services connect, but does not offer a controlled comparison of those outcomes between bundled and separate vendors.
Set up DNS and hosted mail without disrupting delivery
- Choose the mail service first. Confirm whether you need forwarding or hosted mailboxes, and identify the provider that should receive incoming mail.
- Confirm control of DNS. Sign in to the provider hosting the domain’s active nameservers and make sure you have permission to edit its records. If the mail provider offers an automated connection, check whether it is supported for your DNS provider.
- Verify the domain and add the provider’s records. Follow the mail provider’s current instructions for ownership verification and mail records, including any MX and authentication records. Use values shown for your account and region or data center.
- Check proxy status where applicable. For Cloudflare, keep MX records unproxied and email-only A/AAAA records DNS-only.
- Test mail flow. After records are in place, check that the intended service can receive mail and that your sending setup is configured as the provider specifies.
For Google Workspace on Cloudflare, the vendor’s guide covers domain verification, MX, SPF, DKIM, and DMARC. For Microsoft 365, Microsoft supports either Domain Connect or manual records. For Zoho, use the verification method and delivery values displayed for your account. These instructions can change, so follow the current account-specific setup rather than copying records from another domain.
Plan a mail move before changing MX records
Changing MX records is a mail-routing cutover, not a migration of stored messages. Microsoft instructs administrators moving to Microsoft 365 to create user mailboxes before changing MX. After the change, new incoming messages are directed to Microsoft 365; messages already stored at the old host remain there unless they are migrated. Microsoft’s email migration guidance
Rank #4
- ARM core, Cortex-M0 solution, equipped with deeply optimized TCP/IP protocol stack. It has low latency and strong scalability, stable and reliable
- Supports custom webpage function to help users improve brand influence
- Supports Modbus RTU to Modbus TCP protocol conversion and multi-host polling
- Supports hardware and software watchdog, automatically restarts when the device goes down.
- Versatile operation modes: TCP Server, TCP Client, UDP, HTTP client.
- Create and check the destination mailboxes.
- Decide how existing mail at the old host will be migrated, if it needs to move.
- Change MX records only when the destination is ready to receive new mail.
- Verify delivery to the new service and retain access to the old host until you have confirmed that any needed messages and data are accounted for.
Do not delete or replace existing MX records simply to test a new provider. First confirm the intended cutover and that the destination mailboxes exist.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →One credential is not the same as reusing one password
“One credential” can refer to different arrangements, and they have different security implications:
Best Value
- Watchguard T145 Firebox with 1 Year Standard Support License (WGT145001) - The Firebox T145 delivers enterprise-grade protection for branch offices and retail sites. With a blend of 2.5Gb, 1Gb, and SFP/SFP+ ports, it supports high throughput, AI-driven malware protection, and DNS filtering for robust network defense.
- Standard Support covers software updates and round-the-clock emergency help. Add a Basic or Total Security Suite to activate IPS, gateway antivirus, and web filtering so threats are blocked before they reach users.
- Standard Support provides reliable technical assistance and software updates for WatchGuard Firebox appliances. Offering 24x7 help for emergencies and business-hours support for routine needs, it ensures your network stays secure and operational.
- Interfaces and deployment: 2.5Gb and 1Gb Ethernet with SFP or SFP+ fiber for clean aggregation and segmented backhaul at the edge.
- Performance and scale: UTM up to 710 Mbps with inspection on; flexible VPN topologies for hub and spoke or mesh designs.
- One vendor account manages multiple services: This can consolidate administration, but makes securing and recovering that account particularly important.
- Separate accounts with unique passwords: Each provider has its own sign-in. A password manager can help manage distinct passwords without reusing one password across sites.
- Single sign-on (SSO): A supported identity provider authenticates you to connected services. CISA describes SSO as authenticating once to a centralized SSO solution, typically using strong MFA; credentials for that initial system are not shared with every connected service. Using the same password on unrelated vendor sites is not SSO.
CISA says MFA makes it harder for an attacker to access systems such as email and billing even if a password is compromised. NIST identifies password reuse across systems as a risk and recommends maintaining at least two separate means of authentication to reduce recovery difficulty. CISA: More than a Password · CISA phishing-resistant MFA guidance · NIST Digital Identity Guidelines
- Enable MFA on the registrar, DNS, and mail accounts where available; use phishing-resistant options where supported.
- Keep at least two usable authentication or recovery methods, and confirm they remain accessible.
- Check which person or team controls recovery channels, especially when one account administers several services.
- A FIDO2 security key is an optional way to strengthen sign-in only if the specific vendors support it; it is not required for DNS or email setup.
Advanced case: split delivery across mail providers
It is possible to route mail between Zoho and Google Workspace, but Zoho describes this as a configuration involving routing rules and a combined SPF record. It is not a matter of casually adding both providers’ MX records: the routing must be designed for the intended recipients and tested. Zoho split-delivery guidance
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
