Folio
Start free

Dept. of migrations · AWS WorkMail → Folio

Folio pulls the mail.
You just flip DNS.

AWS is retiring WorkMail — support ends 31 March 2027, after which mailboxes become inaccessible. Moving to Folio has two parts: Folio connects to your WorkMail mailbox over IMAP and imports your historical mail automatically — no manual export — while a separate DNS cutover (about ten minutes of registrar work) moves new mail over. The import only ever reads WorkMail and never changes it, so you can confirm everything arrived before you touch a single DNS record.

AWS WorkMail support ends 31 March 2027AWS notice →

Import my WorkMail →Free to start · the import only reads your mailbox — nothing in WorkMail is deleted or changed

This isn't an export-then-upload workflow. Connect your WorkMail mailbox over IMAP after signup and Folio reads it in full — every message and its attachments — while you handle the DNS side below at your own pace.

Type your domain to personalize the records. The DNS steps run independently of the import — do them in either order, or the same afternoon.

Still weighing whether to leave WorkMail at all? The full comparison covers pricing, support, and the other alternatives before you commit to this path.

Updated 12 July 2026 (2026-07-12)

The part that isn't manual

Connect once. Folio reads the mailbox.

After signup, open Migrate from AWS WorkMail from your dashboard, enter your WorkMail address and an IMAP password, and Folio imports your historical mail as a background job — dedupe means a re-run never creates copies, and you can check progress or walk away and come back. Nothing is ever exported by hand.

The credential is used once, over an IMAPS (TLS) connection on port 993, then discarded — never written to a database or a log, and never held past the import job. Details on Folio's trust center →

Import my WorkMail →

Is this migration right for you?

  • You need your mail moved. The import brings over your messages and their attachments. Calendars and contacts aren't carried over IMAP — export those from the WorkMail console separately.
  • One mailbox at a time. Run it once per mailbox, each with its own WorkMail address and password. Ideal for a solo operator or a few inboxes, not a bulk org-wide migration in a single pass.
  • Your WorkMail region is supported. Pick it below — the eight common regions are covered.
  • You can get an IMAP password. If your organization uses SSO, generate an app-specific password in the WorkMail management console.
  • You'd rather not wait until 2027. Support ends 31 March 2027; moving now leaves plenty of room to check everything landed.
  • You want a permanent inbox, not a temporary one. This is a full mailbox migration. If you actually just need a disposable address for one signup or a single thread, Emcognito handles that instead, free — no need to move anything.
Proof of move · enter once, used throughout
Registrar

New to DNS? Start here

DNS is just the internet's phone book — it's how "yourdomain.com" tells the world where to send things. An MX record is the one line in that phone book that says "deliver mail here." A TXT record is a small text stamp that proves you're allowed to send mail as your domain, so spam filters trust it. Below, you're only ever touching those mail-routing lines — not your website, not your files, nothing else on the domain changes.

If any of this still feels unfamiliar once you're in your registrar's dashboard, the record cards below are built to be copy-pasted exactly as shown — you don't need to understand DNS to get it right, just to paste carefully.

Preflight · before the DNS cutover

Lower the TTL.

The cutover itself takes seconds — remove one MX row, keep the other. The slow part is DNS propagation, capped by however long resolvers cache your current MX. Give yourself rollback insurance before you touch anything else.

  1. i Open your registrar (Route 53). Find the MX record for your-domain.com.
  2. iiLower its TTL to 300. Save.
  3. iiiWait an hour, then continue to Stage I — or start the mail import in the meantime.

Stage I · no downtime · safe at any time

Add Folio's three records.

Publish these alongside your existing WorkMail records. Mail keeps flowing through WorkMail; nothing changes yet.

  1. № 01MX
    Host
    your-domain.com
    Value
    10 inbound.wm.emcognito.com

    Folio's inbound MTA becomes the domain's mail receiver. Priority 10 — no backup record needed.

  2. № 02TXT
    Host
    your-domain.com
    Value
    v=spf1 include:emcognito.com ~all

    SPF authorizes Folio's outbound IPs. DMARC below is what actually enforces alignment.

  3. № 03TXT
    Host
    _dmarc.your-domain.com
    Value
    v=DMARC1; p=reject; sp=reject; adkim=s; aspf=r; rua=mailto:dmarc-rua@your-domain.com

    Strict DKIM-aligned DMARC. Reports flow to your own dmarc-rua@ address, a receive-only mailbox Folio manages — don't add another _dmarc record.

On Route 53

Hosted zones → your domain → Create record. Route 53 is also where most WorkMail organizations already keep their MX — look for a record with a WorkMail-managed comment before deleting it.

Two more records — per-domain DKIM and SES verification — are account-specific and get generated when you sign up. The in-app domain wizard hands you those values in the same place you pasted these.

Stage II · the cutover · about five minutes

Remove WorkMail's MX.

Folio's MX sits inert until WorkMail's row is gone. AWS WorkMail's documented inbound format is 10 inbound-smtp.<region>.amazonaws.com — confirm the exact row in your own DNS panel before deleting; the region picker above fills in the expected value for reference.

Delete thisfrom the MX records on your-domain.com
  1. 10 inbound-smtp.us-east-1.amazonaws.com

Match what's actually published for your domain — the region above is a starting point, not a substitute for checking your WorkMail admin console or DNS panel directly.

The MX added in Stage I is now the only one on your-domain.com. New mail begins arriving in Folio as resolvers refresh within the TTL window from Stage 0.

Open the first letter

Bring your-domain.com
home.

Sign up, connect WorkMail for the automatic import, and publish the DNS records above in whichever order suits you — both finish on their own timeline, and neither blocks the other.

WorkMail billed per mailbox. Folio is flat — every domain you own, one price, from $3.50/mo · full pricing →

Import my WorkMail →See what it costs

No card needed. The first domain you bind and the first 100 sends are free.

Common questions

Questions WorkMail switchers ask.

Does Folio really import my mail automatically, or do I still have to export it myself?

Folio connects directly to your WorkMail mailbox over IMAP and pulls every message itself — you don't export a file or upload anything. You enter your WorkMail address and an IMAP-capable password once, Folio reads your folders, and the import runs as a background job you can check on.

Is my WorkMail password stored anywhere?

No. It's used once, to open the IMAP connection for the import, and is never written to a database, a log, or anywhere else. If the import needs to be re-run later, you re-enter it — nothing persists between sessions.

Will mail bounce during the DNS cutover?

No, if you follow the overlap plan below: lower your MX TTL first, publish Folio's records alongside WorkMail's, then remove WorkMail's MX. Both mail servers accept inbound mail during the overlap window.

What if my organization requires an app-specific password for IMAP?

Use it — that's the recommended credential for this import, not your primary WorkMail/SSO password. AWS WorkMail administrators can generate app passwords from the WorkMail management console if IMAP access needs one.

Can I import more than one WorkMail mailbox?

Yes — run the import once per mailbox. Each mailbox is its own IMAP connection, with its own WorkMail address and password, and each domain still gets its own DNS cutover. It's built for a solo operator or a handful of inboxes, not a bulk admin migration across an entire organization in one pass.

Does Folio move my WorkMail calendar and contacts too?

Not currently. The import runs over IMAP, which carries mail and its attachments but not calendars or contacts. Export those from the WorkMail console separately before support ends on 31 March 2027 if you need to keep them.

Do I have to commit to the full move before I know it worked?

No. The import only reads from WorkMail over IMAP — it never deletes or modifies anything there, so your existing mailbox stays exactly as it was. Run the import, check that everything landed correctly in Folio, and only start the DNS cutover once you're satisfied. The two steps are independent; nothing about connecting WorkMail commits you to flipping DNS.

Sources & further reading