Folio
Start free

Dept. of migrations · AWS WorkMail → Folio

Folio pulls the mail.
You just flip DNS.

Migrating from AWS WorkMail to Folio has two parts: Folio connects to your WorkMail mailbox over IMAP and imports your historical mail automatically — no manual export — and separately, a DNS cutover (about ten minutes of registrar work) moves new mail from WorkMail's inbox to Folio's. Both can happen the same day; the DNS side is the only part that needs care around timing.

This isn't an export-then-upload workflow. Connect your WorkMail mailbox over IMAP after signup and Folio reads every folder itself — inbox, sent, whatever else is in there — while you handle the DNS side below at your own pace.

Type your domain to personalize the records. The DNS steps run independently of the import — do them in either order, or the same afternoon.

Still weighing whether to leave WorkMail at all? The full comparison covers pricing, support, and the other alternatives before you commit to this path.

Updated 10 July 2026 (2026-07-10)

The part that isn't manual

Connect once. Folio reads the mailbox.

After signup, open Migrate from AWS WorkMail from your dashboard, enter your WorkMail address and an IMAP password, and Folio imports your historical mail as a background job — dedupe means a re-run never creates copies, and you can check progress or walk away and come back. Nothing is ever exported by hand, and the credential is used once and never stored.

Sign up and connect →
Proof of move · enter once, used throughout
Registrar

Preflight · before the DNS cutover

Lower the TTL.

The cutover itself takes seconds — remove one MX row, keep the other. The slow part is DNS propagation, capped by however long resolvers cache your current MX. Give yourself rollback insurance before you touch anything else.

  1. i Open your registrar (Route 53). Find the MX record for your-domain.com.
  2. iiLower its TTL to 300. Save.
  3. iiiWait an hour, then continue to Stage I — or start the mail import in the meantime.

Stage I · no downtime · safe at any time

Add Folio's three records.

Publish these alongside your existing WorkMail records. Mail keeps flowing through WorkMail; nothing changes yet.

  1. № 01MX
    Host
    your-domain.com
    Value
    10 inbound.wm.emcognito.com

    Folio's inbound MTA becomes the domain's mail receiver. Priority 10 — no backup record needed.

  2. № 02TXT
    Host
    your-domain.com
    Value
    v=spf1 include:emcognito.com ~all

    SPF authorizes Folio's outbound IPs. DMARC below is what actually enforces alignment.

  3. № 03TXT
    Host
    _dmarc.your-domain.com
    Value
    v=DMARC1; p=reject; sp=reject; adkim=s; aspf=r; rua=mailto:dmarc-rua@your-domain.com

    Strict DKIM-aligned DMARC. Reports flow to your own dmarc-rua@ address, a receive-only mailbox Folio manages — don't add another _dmarc record.

On Route 53

Hosted zones → your domain → Create record. Route 53 is also where most WorkMail organizations already keep their MX — look for a record with a WorkMail-managed comment before deleting it.

Two more records — per-domain DKIM and SES verification — are account-specific and get generated when you sign up. The in-app domain wizard hands you those values in the same place you pasted these.

Stage II · the cutover · about five minutes

Remove WorkMail's MX.

Folio's MX sits inert until WorkMail's row is gone. AWS WorkMail's documented inbound format is 10 inbound-smtp.<region>.amazonaws.com — confirm the exact row in your own DNS panel before deleting; the region picker above fills in the expected value for reference.

Delete thisfrom the MX records on your-domain.com
  1. 10 inbound-smtp.us-east-1.amazonaws.com

Match what's actually published for your domain — the region above is a starting point, not a substitute for checking your WorkMail admin console or DNS panel directly.

The MX added in Stage I is now the only one on your-domain.com. New mail begins arriving in Folio as resolvers refresh within the TTL window from Stage 0.

Open the first letter

Bring your-domain.com
home.

Sign up, connect WorkMail for the automatic import, and publish the DNS records above in whichever order suits you — both finish on their own timeline, and neither blocks the other.

Set up your domain →See what it costs

No card needed. The first domain you bind and the first 100 sends are free.

Common questions

Questions WorkMail switchers ask.

Does Folio really import my mail automatically, or do I still have to export it myself?

Folio connects directly to your WorkMail mailbox over IMAP and pulls every message itself — you don't export a file or upload anything. You enter your WorkMail address and an IMAP-capable password once, Folio reads your folders, and the import runs as a background job you can check on.

Is my WorkMail password stored anywhere?

No. It's used once, to open the IMAP connection for the import, and is never written to a database, a log, or anywhere else. If the import needs to be re-run later, you re-enter it — nothing persists between sessions.

Will mail bounce during the DNS cutover?

No, if you follow the overlap plan below: lower your MX TTL first, publish Folio's records alongside WorkMail's, then remove WorkMail's MX. Both mail servers accept inbound mail during the overlap window.

What if my organization requires an app-specific password for IMAP?

Use it — that's the recommended credential for this import, not your primary WorkMail/SSO password. AWS WorkMail administrators can generate app passwords from the WorkMail management console if IMAP access needs one.

Can I import mail for more than one WorkMail domain?

Run the import once per domain. Each domain gets its own destination and its own DNS cutover — the same per-domain pattern as the DNS steps below.

Sources & further reading