Beyond Finance › Practice 04 › Offshore setup
Offshore setup & technical infrastructure

Your Hong Kong company is registered. Now make it operable.

The incorporation agent files the paperwork and opens the bank account, then hands you a certificate and stops. What nobody sells you is the part where mail to your own domain bounces, DNS changes do not take effect, and no one will tell you which of the four records is wrong. That is the gap this service closes.

Where it stalls

Four places a new offshore company loses two weeks.

None of these are hard problems. They are unfamiliar problems, and every one of them fails quietly rather than loudly.

Mail that silently goes to spam

You can send. The recipient never sees it. Usually a missing DKIM signature, or two separate SPF records where the specification allows exactly one — both of which fail without any error message on your side.

The host record question

Whether a record goes on @, on a subdomain, or on the fully qualified name differs by provider, and getting it wrong produces a verification screen that simply never turns green.

Server region chosen by price alone

Region determines latency for your customers, latency for you when administering it, and in some cases which payment methods and services you can use at all. It is a decision worth ten minutes before purchase and expensive to reverse afterwards.

Verification documents that disagree

International platforms compare your ID, your proof of address and your card statement. Registered address, where you actually live and where your card is billed are frequently three different places, and the rejection message never says which one it objected to.

What you get

A company that can send mail, serve a site and pass verification.

Scoped as fixed-price packages. You are told the number before the work starts, and you are not paying by the hour for somebody else's debugging.

01

Domain email that delivers

  • MX records for inbound mail, pointed at the forwarding or mailbox service that fits your volume and budget
  • SPF, DKIM and DMARC published and verified against a real test send, not just saved in the DNS panel
  • Outbound relay configured so mail from your domain is authenticated rather than merely spoofed
  • Send-as set up inside the mail client you already use, so you are not made to adopt a new inbox
02

DNS and registrar

  • A decision on whether to move to managed DNS or stay with the registrar, made on your actual requirements rather than by default
  • Multiple providers' SPF includes merged into one valid record, instead of the two that break authentication
  • Records checked from outside your own network, because a local resolver cache will happily lie to you
03

Cloud server

  • Region chosen against where your customers are and where you administer from, with the trade-offs stated
  • Instance sizing, key-based login rather than passwords, and a security group that opens what is needed and nothing else
  • Bandwidth billing mode matched to your traffic shape, which is usually the difference between a small bill and a surprising one
04

Deployment

  • Nginx configured with the virtual hosts, redirects and cache headers your project actually needs
  • TLS certificates with automatic renewal, and the renewal proven by a dry run rather than assumed
  • Your application stack installed and running as a supervised service that survives a reboot
  • A written deployment path, short enough that you can run the next update yourself
05

Platform onboarding

  • Identity and address verification on international freelance and marketplace platforms
  • A consistent story across your ID, your address evidence and your billing details, decided before you submit rather than after a rejection
  • Which document types these platforms actually accept, which is narrower than what they list
How it runs

Four steps, and you keep every credential.

Accounts are opened in your name, on your payment method. We configure; we do not become a dependency you have to buy back later.

STEP 01

Scope call

What the company needs to be able to do, what already exists, and which platforms you have to satisfy. Usually under an hour.

STEP 02

Fixed quote

A written scope and one number. If something turns out to be outside it, you are told before any extra work happens, not on the invoice.

STEP 03

Configure and verify

Every item is tested from outside your network — a real send, a real fetch, a real renewal dry run — rather than declared done because the panel saved it.

STEP 04

Handover

A short document recording what was set where, why each choice was made, and what you would change if a provider or a requirement changes later.

Common questions

The questions people actually ask first.

Do you register the company as well?

No. Company formation, bank account opening and annual filings are well served by existing agents, and we do not compete with them. We pick up after incorporation, and we are happy to work alongside whichever agent you are already using.

Why does mail from my own domain land in spam?

Almost always authentication. Receiving servers check three things: SPF, which lists who may send for your domain; DKIM, a signature proving the message was not altered; and DMARC, which tells the receiver what to do when the first two disagree. Miss any of them and delivery becomes a matter of the recipient's mood.

The most common single fault we see is two SPF records on one domain. The specification permits exactly one, and a second does not add to the first — it invalidates both.

Can I keep using Gmail or Outlook?

Yes, and most clients do. Inbound mail to your domain is forwarded into the mailbox you already read, and outbound is authenticated through a relay so that replies leave as your company address. You get a company identity without changing where you work.

Do I have to move my DNS to a different provider?

Not necessarily. Managed DNS is worth it if you need fast propagation, proxying or fine-grained records; the registrar's own DNS is perfectly adequate for a small company that changes records twice a year. The decision follows your requirements, not a preference.

Which server region should I choose?

It depends on three things in this order: where your customers load the site from, where you sit when you administer it, and whether the provider's account and payment rules in that region work for you. Price is the fourth consideration, not the first.

My address documents do not match each other. Is that fatal?

No, but it needs deciding before you submit rather than after. Platforms compare identity, address evidence and billing details, and a mismatch between your registered address, your residence and your card statement is extremely common. The workable approach is to choose one consistent version and make every document you submit agree with it.

How long does the whole thing take?

The configuration work is usually days rather than weeks. The binding constraint is rarely us — it is DNS propagation, a platform's verification queue, or a provider's own review. We tell you which parts we control and which we can only wait on.

Who holds the accounts and the credentials?

You do, throughout. Every account is opened in your name on your own payment method, and every credential stays with you. Nothing about this engagement should make it harder for you to leave.

Tell us what is not working yet.

A short description of what you have already set up and what is still failing is enough to quote against. We reply to every serious enquiry within two working days.