A supplier in Lusaka sends a quotation for K180,000 worth of work. The quote is competitive, the company is capable, the timeline is realistic. It is sent from a Gmail address, and it lands in the procurement officer’s spam folder. Nobody ever reads it. The supplier assumes they lost on price.
This happens constantly, and the businesses it happens to almost never find out. Email is the least glamorous thing a company owns and one of the few that quietly decides whether serious buyers take you seriously. The good news is that it is cheap to fix, usually in a single afternoon.
The four ways it goes wrong
1. You are still on a free address
A quotation from [email protected] tells a procurement officer something you did not intend to tell them. Rightly or not, it reads as informal, possibly temporary, possibly one person with a laptop. When your quote sits next to one from a competitor writing from their own domain, you have handed them an advantage before either document is read.
There is a practical problem too. A free address does not scale. When you hire, the new person gets their own personal address, and now your company’s correspondence is scattered across four inboxes that nobody controls.
2. Your mail is landing in spam
This is the expensive one, because it is invisible. Mail providers check whether a message genuinely came from the domain it claims to. That check depends on three DNS records — SPF, DKIM and DMARC. If they are missing or misconfigured, your mail gets treated as suspicious.
Most small businesses in Zambia have never heard of these records and have no idea whether theirs are set. The symptom is not an error message. The symptom is silence: proposals that get no reply, invoices that clients swear never arrived, a follow-up call where the buyer says they have nothing from you. Everyone assumes the client went cold. Often the client never saw it.
3. The inbox walks out with the staff member
An employee sets up the company email on their personal phone using their own account. They leave, and the mailbox goes with them. Sometimes the domain itself was registered in their name, which is worse.
Every client conversation, every quotation, every supplier thread is now outside your control. We have seen businesses lose years of correspondence this way, and in a dispute that correspondence is your evidence.
4. Shared logins and no backup
One password for info@, known to six people, unchanged for three years. No two-factor authentication. No backup. Business email compromise — where an attacker gets into an account, watches quietly, then sends a client amended banking details just before a payment — is one of the most common frauds affecting Zambian companies right now. It works because the message really does come from your account.
What good actually looks like
- The domain is registered to the company, not to a staff member or the person who built the website. You hold the registrar login.
- Every person has a named mailbox — firstname@ — with shared addresses like info@ or sales@ set up as aliases or shared inboxes that several people can reach.
- SPF, DKIM and DMARC are configured and verified, so your mail authenticates and reaches the inbox instead of the spam folder.
- Two-factor authentication is on for every account, without exception.
- Mail is backed up somewhere other than the mail server itself.
- Offboarding is a documented step: when someone resigns, their mailbox is suspended, forwarded to their manager, and the password changed the same day.
- A signature standard exists so every message carries the same name, title, phone number and website.
Check yours in ten minutes
Run through this list honestly:
- Who is the registered owner of your domain? If you are not certain, that is the first thing to establish.
- Send a message from your business address to a personal Gmail account. Did it reach the inbox or the spam folder?
- Ask a client whether your last invoice arrived normally.
- Can you name every mailbox on your domain, and does each belong to someone still employed?
- If your longest-serving employee resigned tomorrow, would you still have access to their correspondence?
- Is two-factor authentication switched on for the account that receives payment queries?
Any answer you are unsure about is worth resolving now rather than during a dispute.
The cost is smaller than you think
Businesses postpone this because they assume proper email means an enterprise contract. It does not. Professional mailboxes on your own domain, properly authenticated and secured, cost a modest amount per user per month — considerably less than a single lost tender.
The setup is a one-off exercise: register or reclaim the domain, provision the mailboxes, publish the DNS records, migrate existing mail, switch on two-factor, document the offboarding step. For most small companies it is done within a day, and it stays done.
Where we come in
At Lightwins Creations we run email infrastructure audits for exactly this: we check domain ownership, test deliverability, review your DNS records, look at how mailboxes are provisioned and secured, then remediate what we find and hand you documentation. For businesses that would rather not think about it again, we provide it as part of a monthly IT support arrangement covering email, backups, user accounts and day-to-day technical issues.
If you are not sure whether your mail is reaching people, that uncertainty is itself worth an hour of someone’s attention. We are happy to take a look.
Lightwins Creations
Woodgate House, Cairo Road, Lusaka
Email: [email protected]
Phone: +260 976 351 166
