Email on your own domain, done properly

What Yowl is

You have a domain. Yowl becomes its mail. Every address on it exists the moment someone writes to it, so billing@, jeff@ and the address you made up for one supplier all work without anyone creating them. Everything that arrives is kept. The AI reads each message and whatever is attached, files it under a category, and puts anything it cannot place under a single “Needs a look” heading. Your team works one inbox on a private page at your organisation’s own subdomain, and a reply goes out from whichever address the mail came in on. Google Workspace charges per mailbox and leaves the sorting to you.

Your agent drafts your emails, you review and send. Paste one URL into Claude and it signs in beside the humans, using the same addresses and seeing the same inbox. It reads the PDF a customer sent, fills in the spreadsheet they attached, and leaves the finished file on a draft reply with a note in the team chat. Your agent is a real member of your team, and can do anything a real member can.

One shop for the whole life of a domain’s mail. Register the name, point the DNS, publish the records, verify them, move the mail across from wherever it is now, import the old mailbox, read the DMARC reports and climb the policy ladder — and then actually work the inbox. That is normally five companies with five dashboards, none of which can see the other four, which is why almost every failure in the guides below is really a seam between two of them. Here it is one account, one picture, and one thing to ask.

And it is all reachable by your agent. Everything on that list is exposed over MCP, so “is anything wrong with our mail?” is a question with a real answer rather than four tabs and a dig.

Some things Yowl does that a mail host usually does not:

• Senders are never written to. No auto-reply, no “confirm you are human”, no bounce for an address that does not exist. The person who registered the domain is the customer; the people who write in are asked for nothing.
• Nothing is deleted. Not by a filter, not by the AI, not by a member tidying up. “The email never arrived” has an answer every time, because the message is there, filed or muted or deduplicated, and Yowl can show you which.
• It watches the domain’s mail health, not only its inbox. The DMARC record is checked, the reports come back to an address on your domain, and when they have been clean for a fortnight Yowl says it is time to tighten the policy. You can run that check on any domain without registering.
• Buy the domain inside Yowl. If the name you want is free, Yowl registers it, publishes the records and has the inbox live before you have closed the tab.
• The team’s todo list lives beside the inbox. A todo can point at the mail it came from and the file that answers it, and the agent ticks items as it does them.

Not everything is on the list. There is no IMAP, no POP and no desktop client: the web inbox and the AI are the product. Yowl does not send campaigns. Nobody is charged per person. And Yowl does not run a browser for your agent; bring one if you need it.

Yowl has carried our own company’s domains since August 2026. The first document an agent handled end to end was our accountant’s invoice, on 22 September: forwarded in, read from the PDF, annotated, written into the organisation’s files and left on a draft for a human to send.

The guides

Running mail on a domain you own comes with a set of jobs nobody hands you. The guides below are those jobs, in the order you meet them. After each, a line on where Yowl picks up.

Start with the domain

A variant domain beside the main one, acme.email next to acme.com, has no mailboxes and no history. Point it at a shared inbox and nothing that already works is touched. How to buy a second domain for team mail covers which TLDs old validation code rejects, what the registry’s own terms cost you — .co.za has no renewal grace at all, so a card that fails on renewal day takes the domain down — and the order that avoids starting a 60-day transfer lock on yourself.

In Yowl: an organisation links one domain, and if the variant you want is free Yowl will register it for you and publish the records itself.

Until it sends, make it say so

A domain you own but do not send from can still be forged in a From line, and receivers have nothing to check the claim against until your DNS says otherwise. Three records close that: a null MX, an SPF record that authorises nobody, and DMARC set to reject — on the apex and on a wildcard, because a hostname with a web server and no MX is a mail destination whether you meant it or not. We published them on yowl.io itself on 24 September 2026, the day we bought it, and the guide includes the DKIM record most advice tells you to add and M3AAWG explicitly says not to.

In Yowl: when you connect a domain, the setup reads what is published now and lists which of the three to replace, in what order. Yowl never edits your DNS; you paste each record yourself.

The three records that decide whether your mail is believed

SPF names the hosts allowed to send for your domain, and breaks in four ways: a second record at the apex, an eleventh lookup, two void lookups nobody counts, and the wrong all qualifier — all four, with the checks. Before any of that, it is worth knowing which record a receiver actually reads, because for most transactional mail it is not the apex one.

In Yowl: our sending record lives on a subdomain, so your apex SPF is never edited and the two-records outage cannot happen.

DKIM signs each message with a key you publish, and unlike SPF the signature survives forwarding. How to set up DKIM covers selectors and rotation, and the CNAME most providers now hand you instead of a key. When the record is published and verification still refuses, three different bugs look identical — and two get worse if you re-paste the key.

In Yowl: the key sits under its own selector, beside whatever your previous provider left, so the two never collide during a move.

DMARC ties the two together and tells receivers what to do when both fail, and where to send the report. Check the record you already have before you paste a new one: replacing yours can weaken your policy, and adding one beside it switches DMARC off entirely. The specification also changed in May 2026 — pct is gone and the Public Suffix List went with it.

In Yowl: the reports come back to an address on your own domain, which Yowl already hosts, and the domain page shows the next step and nothing else. When the reports have been clean for two weeks it says so.

Receiving: one inbox, every address

A catch-all turns every address on the domain into a real one, invoices@ or the spelling of your name a customer guessed at, at the cost of receiving everything. How to set up a catch-all address shows the switch on Google Workspace, Microsoft 365, Cloudflare and cPanel, when to leave it off, and the five addresses a catch-all quietly hands to everyone who can read it. Running one for other people is a different problem: routing a multi-tenant catch-all.

In Yowl: the organisation’s mailbox is a catch-all by design. What makes that liveable is the sorting: mail the AI recognises is filed under its category, and the rest waits under one “Needs a look” heading instead of spreading across the page.

Trying it without touching DNS

Forwarding one mailbox into a shared inbox is the smallest possible experiment, and it has a quirk: SPF fails at the destination by definition. How to forward Gmail or Outlook to a shared inbox covers the confirmation step, why ARC exists, and the Microsoft 365 policy that blocks external forwarding by default while letting the setting save. Then what actually breaks once it flows — the envelope stops naming the sender, the catch-all closes a loop, and de-duplicating by similarity hides passcodes.

In Yowl: your organisation has an address the day you register. Forward one mailbox to it and the team is reading sorted mail before any record changes.

Leaving somewhere else

If you are on HEY for Domains, the export is one MBOX file and the DNS swap is one record. The Imbox, the Feed and the Paper Trail are HEY’s structure rather than anything in the messages, so they stay behind, and there are two things to test before you cancel: whether HEY keeps delivering mail between your own users after the MX moves, and whether it keeps the domain claimed afterwards. How to migrate from HEY has the export, the records, and the reason to export before cancelling rather than after — the thirty-day retention window people cite is not in HEY’s documentation.

In Yowl: new mail arrives from the moment the MX changes, and the MBOX you exported comes with you — read in message by message, dated by each message’s own header so the archive interleaves with new mail rather than landing in a lump. The sorting you did by hand in the Screener happens on arrival.

Not locking yourself out on the way

Whatever you are leaving, work out what the domain’s address unlocks before you move it — usually the registrar, the DNS provider and the hosting account, each of which sends its password resets there. Moving the mailbox onto infrastructure that also serves the DNS closes a circle. How to migrate your domain’s email without locking yourself out has the loop, why a second admin user beats a second address, and which providers even offer one. ⛔ And before you change a nameserver at all, the DS record that takes the whole domain dark — signed by default on a domain nobody configured.

In Yowl: a Yowl address is a fine login for those accounts, provided each has a second way in that does not route through Yowl.

When something looks wrong

The answer is nearly always in the headers, and if you are reading them in code rather than by eye, the grammar is regular and real headers are not — an authserv-id you must match exactly, a semicolon that introduces rather than separates, and two properties that are not in anybody’s registry.

In Yowl: you ask. Every message is kept byte for byte as it arrived, the verdict is computed at ingest, and your agent answers “did this actually come from who it says?” without you opening a header at all.

Giving Claude an address

How to give Claude an email address is the procedure for a human with a Claude account: about ten minutes, no code.

In Yowl: your agent is a real member of your team, and can do anything a real member can: read the inbox, write files into the organisation, draft replies, talk in the team chat. Your agent drafts your emails, you review and send.

Yowl runs at yowl.co.za. An organisation is free; a domain is optional.