Business Email
Keep your team in Outlook, with spam, malware and phishing stopped before the inbox
Exchange mailboxes on your own domain: every message passes through layered security gateways, and the mail you send arrives signed, from addresses whose reputation is watched.
Why now
- Accounting paid a new account number from an email that looked like it came from a supplier, and the supplier knew nothing about it. Sender reputation, forged-domain checks and phishing protection exist to stop that message before it reaches the inbox.
- The proposals you send land in customers' spam folders, and the sales team calls every day to ask whether the email arrived. With DKIM signing, SPF and DMARC set up correctly, your mail arrives as a recognized sender.
- The warranty on your in-house Exchange server is ending, version support is running out, and the one person who keeps mail running is leaving. Having Nesnet run the server, the security layer and the certificates takes that risk off the company.
- An employee's password was stolen, and thousands of spam messages went out from the account overnight; the company's domain ended up on blocklists. A per-sender hourly sending limit and outbound scanning stop that snowball from growing.
- Because of a lawsuit, your lawyer wants two years of a departed manager's mail kept untouched. Litigation hold preserves everything in the mailbox, deleted items included.
What changes
| Today | With Nesnet |
|---|---|
| A fake invoice email lands in accounting's inbox without anyone noticing. | No message reaches the inbox without passing reputation, phishing, malware and attachment checks. |
| Your proposals disappear into the recipient's spam folder. | Outgoing mail is DKIM-signed, and Nesnet sets up your SPF and DMARC records. |
| Someone calls the help desk to recover a deleted email. | Users bring deleted items back themselves from Outlook or the browser. |
| An important message caught as spam means a ticket to IT. | Users see quarantined mail through the link in their digest and release it themselves. |
| The mail server, certificates and spam filter each need their own care. | The same Nesnet team runs Exchange, the security gateways and their certificates. |
From today to live: how it works
- 1
Discovery call
You and the Nesnet team agree how many mailboxes you need, what size, and which shared mailboxes. Where your current mail lives and how it will move is discussed at the same time.
- 2
Your domain is set up
Your domain is defined as an accepted domain in Exchange and verified by reading it back. Your organization and its address book chain are built, and the mailboxes are created.
- 3
DNS records go in
MX, SPF, automatic account setup, DMARC and DKIM records are added to your domain. If your DNS is with Nesnet the panel writes them itself; if it's elsewhere, no mailbox opens on that domain until the records verify.
- 4
Existing mail moves over
Your old mail is imported into the new mailboxes from PST files. The move starts with a pilot group, and once the result checks out, the rest of the users follow in turn.
- 5
The team starts working in Outlook
Users set up Outlook automatically by typing their email address, and add the same mailbox to their phone and browser. Quarantine digests and self-service recovery work from day one.
What you get
Business mail on your own domain
Mailboxes open on your domain, and the domain is verified by reading it back when it's defined in Exchange. Your people write from addresses like name.surname@yourcompany.com, and customers see your company's name instead of a free mail service.
The same mailbox in Outlook, browser and phone
Outlook desktop configures itself through automatic account setup, Outlook on the web opens in the browser, and phones and tablets connect over Exchange ActiveSync. A message read in one place is read everywhere, and a folder moved in one place is moved everywhere.
Mail scanned before it reaches the inbox
Every incoming message passes spam, malware, outbreak filters and file reputation checks on layered mail security gateways before it reaches the mailbox. Suspicious attachments are opened in a closed environment to watch their behavior, and an attachment found malicious never gets in.
Protection against phishing and spoofed senders
Advanced phishing protection, sender domain reputation and content filters are on for incoming mail, and forged envelope domains are checked against DNS. Mail that fails SPF goes to quarantine, and known patterns that deliver ransomware through shared links are filtered out.
Tiered acceptance by sender reputation
Connections from servers with a bad reputation are refused at the door, while suspicious ones are slowed down and scanned more strictly. Mail to addresses that aren't in your directory isn't accepted, and harvesting attacks that guess addresses are stopped.
Outgoing mail is checked too
Mail you send is scanned as well; spam and suspected spam are quarantined instead of going out. A per-sender hourly sending limit means a compromised account can't blast spam, and your domain stays off blocklists.
Keep your mail out of spam folders
Outgoing mail carries a DKIM signature with a strong key, SPF is set up with a single record, and DMARC reports are collected and processed centrally. Nesnet prepares the records, so your proposals and invoices arrive from a recognized sender.
Users manage their own quarantine
Users get a digest every weekday morning for mail held in spam quarantine, and open their quarantine through the link without a separate password. They release an important message themselves and add senders to their personal safe or blocked lists.
Users recover deleted mail themselves
Deleted items are kept in the recoverable items area, and users bring them back with the recover deleted items command in Outlook or the browser, without calling the help desk. With Exchange's default, deleted items can be recovered for two weeks.
Shared mailboxes and distribution groups
Shared mailboxes such as support@ or info@ are created and opened to several people, so incoming requests never get lost in someone's personal inbox. Distribution groups and dynamic groups whose membership updates itself are managed from the same panel.
Meeting rooms and equipment
Meeting rooms and equipment such as projectors get their own mailboxes, with booking rules and capacity defined. Staff add the room to a meeting invite in Outlook, and if the room is taken, the invite is declined automatically.
Archive mailboxes
An archive mailbox is added alongside the user's primary mailbox and opens from Outlook and the browser. Older mail moves to the archive automatically through a retention policy, so the primary mailbox stays light and quota trouble doesn't come back every year.
Litigation hold and in-place hold
Litigation hold preserves everything in a mailbox, including deleted items and the original versions of changed items, for a set period or until the hold is removed. In-place hold protects only the items matching a given search query.
Retention tags and policies
Retention tags apply to folders and items, and items that reach their retention age are moved to the archive or deleted. Users can give their own folders personal tags, while the organization's retention rule works consistently in every mailbox.
A leaver's mailbox isn't lost
A deleted or disabled mailbox stays in the database for Exchange's retention period, a month by default. During that time it can be reconnected to the same or another user, so a successor inherits the history.
Wipe mail from a lost phone
When a phone is lost, an admin starts a remote wipe from the admin screen, or the user starts one from Outlook in the browser. On supported devices only the work account is wiped, leaving personal photos and apps in place.
Delegate permissions and calendar sharing
An assistant can get full access to a manager's mailbox, send as the mailbox itself or send on its behalf, and a full-access mailbox opens in the assistant's Outlook automatically. Calendars are shared with colleagues with read or edit permission.
Organization-wide email signature
Your company signature is written once in the panel and applied to the mailboxes you choose, without overwriting users' own signatures. During a campaign, the announcement in the signature changes across the whole company with a single edit.
Trace a message that didn't arrive
Message trace shows the path of mail for a sender or recipient in your organization for up to the last thirty days. When a customer asks whether you got their email, you answer from the record, not from a guess.
Secure sending from apps and devices
Printers, web forms, ERP and system notifications send mail from your own domain through authenticated submission. That mail goes through the security layer and gets signed too, so an application notification doesn't end up in a spam folder.
Why Nesnet
Mail and its security layer in one team
The Exchange servers and the mail security layer in front of them are infrastructure Nesnet runs itself. Deliverability, DKIM, domain hygiene and quarantine are handled by the same team, so a problem never bounces between two companies.
Sending reputation is watched
The reputation of the addresses Nesnet sends mail from is monitored through the major mailbox providers' feedback programs and blocklist checks. Whether your mail reaches the other side isn't left to chance.
Cross-organization leaks are tested
Each organization has its own address book, and no organization can see another's contacts. Setting up an organization doesn't count as done until its address book chain is complete, and a cross-organization leak test runs with every management action.
Your data stays in Türkiye
Mailboxes and the security layer run in Türkiye, on Nesnet's infrastructure in the Equinix Istanbul (Dudullu) and Türk Telekom Ankara facilities. Your correspondence isn't stored in a data center abroad.
Admin screens in Turkish
The admin panel and user screens work in Turkish and English. Creating mailboxes, shared mailboxes, signatures and quarantine tasks happen in one panel, in the language your team works in.
A monthly fee per mailbox
Invoices are issued as e-invoices or e-archive invoices. Instead of upfront spending on server hardware and security appliances, you are billed monthly per mailbox.
Example scenarios
A fake invoice email that never arrived
Situation
A construction company's accounting team received an email announcing a new bank account, from a domain very close to a regular supplier's name.
Outcome
Sender domain reputation and phishing protection flagged the message as suspicious, and it went to quarantine. The team saw it in the quarantine digest, phoned the supplier and confirmed it was fake.
Proposals no longer land in spam
Situation
A consulting firm's proposals to customers often ended up in the recipient's spam folder. The firm's domain was missing SPF and DKIM records.
Outcome
During the move to Business Email, Nesnet prepared the SPF, DKIM and DMARC records, and outgoing mail started being signed. DMARC reports also revealed another tool sending on the domain's behalf, which was fixed too.
A compromised account, stopped spam
Situation
At a retail company, an employee's password was stolen on a phishing page. Overnight the attacker tried to send thousands of messages from the account.
Outcome
The per-sender hourly limit and outbound scanning stopped the sending quickly, and the spam stayed in quarantine instead of going out. The domain stayed off blocklists, and the password was reset in the morning.
An Exchange server out of warranty
Situation
A manufacturer has run Exchange in its own building for years. The server's warranty is ending, and the one person who manages mail is leaving.
Outcome
Mailboxes were created on Nesnet, old mail was imported from PST files and users moved over in turn. Outlook set itself up when users typed their email address, and server, certificate and spam filter upkeep came off the company's to-do list.
Who does what
| Nesnet | You |
|---|---|
| Builds, runs and updates the Exchange servers and the mail security gateways. | Decide on users, shared mailboxes and groups, and who has access to what. |
| Manages inbound and outbound scanning, quarantine and sending limits. | Add the required records, or have them added, if your DNS is with another provider. |
| Sets up DKIM signing, SPF and DMARC, and monitors sending reputation. | Build phishing awareness among your staff and keep an eye on password practice. |
| Checks certificates daily and renews them before they expire. | Prepare old mail to be moved as PST files. |
| Creates your organization and address book chain and tests isolation between organizations. | Tell Nesnet about your litigation hold and retention requirements. |
Who it is for
Companies that live in Outlook and calendars
Teams whose day runs on Outlook desktop, shared calendars and meeting room bookings. The same mailbox opens with the same folders in Outlook, in the browser and on the phone, so nobody has to change how they work.
Organizations that have been hit by phishing
Companies that lost money or data to a fake invoice email or a malicious attachment. Every incoming message is scanned layer by layer for spam, malware, phishing and suspicious attachments before it reaches the mailbox.
Groups with several companies or brands
Holdings and groups where each company needs its own domain and its own address book. Each company is opened as a separate organization, and one company's staff can't see the other's contacts in the address book.
Organizations sending mail from apps and devices
Companies that want printers, forms, ERP and system notifications to send mail from their own domain. With authenticated submission, that mail goes through the same security layer and carries the same signature.
Organizations with legal retention duties
Legal, finance and healthcare organizations that may need to protect specific mailboxes from deletion because of a lawsuit or an audit. Archive mailboxes, litigation hold and retention policies are turned on with Exchange's own capabilities.
May not be the right fit
If you want mail, chat, meetings and document sharing in one cloud office suite, and having data in data centers abroad isn't a concern, Microsoft 365 or Google Workspace may be a better fit.
If your mail must sit on hardware in your own building, this service doesn't meet that need; in that case you'd run Exchange on your own servers.
Under the hood
Mailboxes run on Microsoft Exchange Server SE inside a replicated Database Availability Group (DAG). New mailboxes are placed only on replicated databases in that DAG; a standalone, unreplicated database is kept out of placement. In front of Exchange sit layered mail security gateways. They share one configuration, so a rule written once lands on all of them. Quarantine, reporting and message tracking are centralised in one management console. Outlook on the web, IMAP and Autodiscover are published behind Nesnet's load balancer. Exchange itself is driven directly by a control panel Nesnet built in-house, which handles organisation setup, domain onboarding and the leak tests. Gateway logs (mail, anti-spam, anti-virus, audit) leave the gateways over TLS for a central log system.
Building blocks
- Replicated mailbox servers
- Exchange Server SE mailboxes, calendars, contacts; Database Availability Group (DAG)
- Layered mail security gateways
- inbound and outbound scanning; several gateways with shared configuration
- Central mail security management
- quarantine, reporting and message tracking
- Load balancer
- load balancing for Outlook on the web, IMAP and Autodiscover
- Nesnet control panel
- Exchange administration, domain and DNS setup, tenant separation
- DMARC report processing
- collection and processing of DMARC aggregate reports
- Automatic certificate management
- gateway certificate, checked daily and renewed before expiry
How it compares
| Option | When it is the right choice |
|---|---|
| Microsoft 365 | The right call if you want mail, Teams, SharePoint and OneDrive in one bundle and are comfortable with data in Microsoft's own data centres. Nesnet can help you decide per user group, and for some teams a mix of the two makes sense. |
| Google Workspace | The lowest-friction option if your team already writes in Gmail and works in Google Docs and Drive. Teams built around desktop Outlook, Exchange calendars and room booking are a more natural fit for Exchange. |
| Exchange on your own servers | Sensible if mail must sit on hardware in your own building and you have staff to handle certificates, spam filtering, outbound IP reputation and DNS. Without that team, running the same Exchange experience at Nesnet takes the workload out of your office. |
Technical specifications
| Mail server | Exchange Server SE |
|---|---|
| Redundancy | Replicated mailbox servers in a Database Availability Group (DAG) |
| Mailbox placement | Replicated databases inside the DAG only |
| Security gateway | Email security gateway, inbound and outbound |
| Gateway layout | Several gateways; a rule written once applies to all of them |
| Central management | Quarantine, reporting and message tracking in one management console |
| Web front end | Outlook on the web, IMAP, Autodiscover behind a load balancer |
| Data centres | Equinix Istanbul (Dudullu) and Türk Telekom Ankara |
| Region | Single region, Turkey |
| Data location | Turkey |
| Desktop Outlook | Outlook Anywhere + Autodiscover (including SRV record) |
|---|---|
| Browser | Outlook on the web (OWA) |
| Phone and tablet | Exchange ActiveSync with device policy |
| IMAP | Enabled |
| Application sending | SMTP, port 587, authenticated |
| EWS | Exchange Web Services endpoint enabled |
| Inbound layers | Spam engine, anti-virus, outbreak filters, file reputation, sandboxed file analysis, graymail classification |
|---|---|
| Phishing protection | Advanced phishing protection, domain reputation, content filters |
| Sender reputation | Global reputation data; poor reputation refused, questionable throttled |
| Recipient validation | Unknown addresses rejected, directory harvest protection |
| Envelope check | Forged envelope sender domain verified in DNS |
| Inbound SPF failure | Quarantined |
| Outbound mail | Anti-spam + DLP; spam is quarantined, not sent |
| Sending limit | Hourly, per sender |
| DKIM | 2048-bit key, relaxed/relaxed; signed at the gateway |
| SPF | Single include record on your domain |
| DMARC reporting | CNAME to a central record; aggregate reports collected and processed |
| TLS | Preferred inbound, enabled outbound; certificate checked daily |
| Quarantine retention | 14 days |
|---|---|
| Digest | Weekdays at 10:00 |
| Quarantine access | Link in the notification, no separate password |
| Deleted item recovery | By the user, from their own panel |
| Message trace window | Last 30 days |
| Migration | PST import and export |
| Archive | Separate mailbox; available in Outlook and Outlook on the web |
|---|---|
| Litigation hold | All content; for a set period or until removed |
| In-place hold | Query-based, archive included |
| Tag types | Default folder, default policy and personal tags |
| Deleted item retention | Exchange default 14 days |
| Deleted mailbox retention | Exchange default 30 days; can be reconnected |
| Remote wipe | Whole device or mail account only |
| Delegate permissions | Full Access, Send As, Send on Behalf |
| Calendar sharing | Read or edit role |
| Tenant separation | Per-organisation GAL, OAB, room list; ABP Routing Agent |
|---|---|
| Retention policy | MRM policy applied to mailboxes |
| Extra storage | Per mailbox, in GB |
| Interface language | Turkish and English |
If something breaks
A gateway goes down
Inbound mail is spread across several gateways behind one MX name at equal priority. If one drops out, the others keep accepting mail.
Outbound path
Exchange spreads outbound mail across the same gateways. Losing one gateway does not stop mail leaving.
Mail queued on a failed gateway
The gateways sync configuration but do not share queues. Mail sitting in a failed gateway's queue is not lost; it is delivered when the gateway returns and waits until then.
Why there is no backup MX
A secondary MX is deliberately not used, because all of the gateways already sit behind the same MX name. If none of them answers, sending servers retry as SMTP requires.
Mail deleted by mistake
Users restore deleted items from Recoverable Items on their own. There is no ticket to raise and no wait for someone to be available.
Certificate expiry
The gateway's certificate is checked daily and renewed automatically before it expires. Renewal does not depend on someone remembering a calendar reminder.
Frequently asked questions
Pricing and first steps
Pricing
Business Email is billed monthly: a monthly fee per mailbox, a per-GB fee for extra storage and a per-user email security line. You can choose monthly or yearly terms; the price is set by your mailbox count and the items you choose, and Nesnet’s team prepares your quote.
What the price depends on
- Number of mailboxes and the package chosen (package limits are fixed at purchase; a change means a new package)
- Extra storage added to mailboxes (GB)
- Number of users covered by email security
- Subscription term: monthly or yearly
How to get started
- 1.Fill in the form or call 0800 606 1071.
- 2.We agree on mailbox count, size and migration path in one call and prepare a price.
- 3.Your domain is set up, DNS records go in and the first mailboxes open.
Leave your mail in Outlook and the security to Nesnet
Tell the Nesnet team how many mailboxes you need and where your mail lives today, and you'll hear back within the same business day. Your team keeps working in the Outlook it knows, and mail is scanned before it reaches the inbox.