iRedMail to JustEmails: Step-by-Step Migration Guide (2026)

The notification came in at 6:47 AM. Dovecot had crashed again.

I'd been running iRedMail on a $10/month Hetzner VPS for two years. Postfix, Dovecot, Amavisd, Roundcube, Fail2ban, Let's Encrypt cron jobs — the whole stack. It worked. Most of the time. And the months it worked, I felt smart. Self-hosted email! No per-user fees! Total control!

Then last month my IP landed on Spamhaus. Someone on the same /24 subnet had been running a botnet. Took four days to get delisted. Four days of client emails bouncing.

Look, iRedMail is solid software. The project maintainers are doing good work. This isn't a hit piece. But self-hosted email asks you to be your own sysadmin, your own spam-filter tuner, your own deliverability consultant, and your own 3 AM on-call engineer. For $49/year, JustEmails handles all of that. Here's how to make the switch without losing a single message.

What You'll Have at the End

A fully working email setup on JustEmails: all historical mail migrated, all mailboxes receiving new mail, SPF/DKIM/DMARC reconfigured, and your iRedMail server ready to decommission. Same IMAP access. Same email addresses. Same clients. Zero maintenance going forward.

Prerequisites

Before starting, you'll need:

• SSH access to your iRedMail server (for IMAP credentials and running imapsync)
• DNS access for your domain (Cloudflare, Namecheap, wherever your nameservers live)
• A JustEmails account — the 7-day free trial works fine for this
• imapsync installed somewhere (your iRedMail server works, or any Linux box)
• IMAP credentials for each mailbox you're migrating
• 2-3 hours of hands-on work spread across 3-4 days

One thing that trips people up: iRedMail stores passwords hashed, not plaintext. You can't just pull credentials from MySQL or LDAP. Either you know the passwords, or you'll need to reset them before migration. If you have 20 mailboxes and nobody remembers their password, that's 20 password resets. Annoying? Yes. But do that before Day 1 or you'll hate yourself on Day 3.

Day 1: Setup and Initial Sync

Step 1: Create Mailboxes in JustEmails

Log into JustEmails. Add your domain — the dashboard prompts you for a TXT record to verify ownership. Once verified, create a mailbox for every account you're migrating from iRedMail.

Match the addresses exactly. If ops@yourdomain.com exists in iRedMail, create ops@yourdomain.com in JustEmails. Don't get clever with address changes during a migration. That's how you lose mail.

JustEmails shows you IMAP/SMTP credentials for each mailbox. Save these somewhere — a password manager, a text file, whatever. You'll need them for imapsync.

(I once lost credentials mid-migration because I closed the browser tab. Spent 20 minutes regenerating passwords. Don't be me.)

Don't touch MX records yet. We're not cutting over today.

Step 2: Install imapsync

If imapsync isn't on your iRedMail server already, install it. On Debian/Ubuntu:

sudo apt update && sudo apt install imapsync

On CentOS/RHEL (iRedMail's usual home):

sudo yum install epel-release
sudo yum install imapsync

Verify:

imapsync --version

You want version 1.9 or higher. Older versions have quirks with folder mapping that'll make you question your life choices.

Step 3: Test IMAP Connectivity

Before running the full sync, verify you can reach both servers. Test iRedMail (source):

openssl s_client -connect localhost:993

You should see certificate info and an IMAP greeting. Good. Test JustEmails (destination):

openssl s_client -connect mail.justemails.app:993

Same deal. If either fails, fix connectivity before proceeding. Firewall rules are the usual culprit on the iRedMail side — port 993 outbound needs to be open. (Ask me how I know.)

Step 4: Run the Initial Bulk Sync

Here's the command template:

imapsync \
  --host1 localhost --port1 993 --ssl1 \
  --user1 "ops@yourdomain.com" --password1 "iredmail-password" \
  --host2 mail.justemails.app --port2 993 --ssl2 \
  --user2 "ops@yourdomain.com" --password2 "justemails-password" \
  --automap

The --automap flag handles folder name translation between Dovecot and JustEmails. Usually works fine. If you have custom folders with weird names, you might need --regextrans2 flags, but that's rare.

Run this for every mailbox. For multiple accounts, script it:

#!/bin/bash
while IFS=',' read -r email iredpass jepass; do
  echo "Syncing $email..."
  imapsync \
    --host1 localhost --port1 993 --ssl1 \
    --user1 "$email" --password1 "$iredpass" \
    --host2 mail.justemails.app --port2 993 --ssl2 \
    --user2 "$email" --password2 "$jepass" \
    --automap
done < users.csv

Create users.csv with columns: email, iRedMail password, JustEmails password. Not encrypted, so delete it after.

(Or use a secrets manager if you're fancy. We're not fancy. We're migrating email at midnight with cold coffee.)

First sync takes a while. A mailbox with 2GB of mail takes 30-60 minutes. Let it run. imapsync is resumable — if it crashes, rerun the same command and it picks up where it left off.

Day 2: Prepare DNS

Step 5: Lower Your MX TTL

Your current MX records probably have a TTL of 3600 (1 hour) or higher. Some people set 86400 (24 hours). Before cutover, drop it to 300 (5 minutes).

In your DNS panel (Cloudflare, Namecheap, etc.), find your MX records and edit the TTL. Save.

Now wait 24 hours. The old TTL needs to expire from caches worldwide before the new short TTL takes effect.

This is boring. I know. Go do something else. But skipping this step is how you get mail delivered to iRedMail for hours after you thought you'd switched. I've seen migrations where someone skipped the TTL prep and spent three days chasing stray messages. Not worth it.

While waiting, grab the DNS records from JustEmails. Your domain settings page shows:

• The MX record (a single host, priority 10)
• The SPF record (a TXT record)
• DKIM CNAMEs (two records)
• MTA-STS policy (if you want it)

Screenshot or copy these. You'll add them tomorrow.

Day 3: The MX Cutover

Step 6: Update MX Records

Delete your old MX records pointing to your iRedMail server. They look something like:

mail.yourdomain.com (priority 10)

Add the JustEmails MX record. There is one, not a pair:

mail1.justemails.app (priority 10)

If you're used to publishing a second MX at priority 20 as a backup, don't bother here — there's nothing to point it at, and a second row aimed at a host that doesn't exist just adds a retry delay to every inbound message. Check your JustEmails dashboard to confirm the value before you save.

Step 7: Update SPF

Your current SPF probably includes your iRedMail server's IP:

v=spf1 ip4:YOUR.SERVER.IP.HERE ~all

Or maybe:

v=spf1 a mx ~all

Change it to:

v=spf1 a:mail1.justemails.app ~all

That a: mechanism authorises whatever IP mail1.justemails.app resolves to, which is the host your mail now leaves from. No include, no separate SPF hostname to look up.

If you send from other services (Mailchimp, a SaaS app, etc.), keep their includes alongside it:

v=spf1 a:mail1.justemails.app include:servers.mcsv.net ~all

One SPF record total. Multiple SPF records breaks validation. I've debugged this for people more times than I want to count. (Honestly, the SPF spec should have just errored loudly instead of silently failing. But here we are.)

Step 8: Add DKIM Records

JustEmails auto-generates DKIM keys. Add the CNAME records from your dashboard. Typically:

je1._domainkey.yourdomain.com → je1.dkim.justemails.app
je2._domainkey.yourdomain.com → je2.dkim.justemails.app

Your old iRedMail DKIM record (dkim._domainkey) can stay or go — it won't hurt anything. Removing it is tidier.

Step 9: Verify Propagation

Don't trust your DNS panel's "changes applied" message. Check externally:

https://mxtoolbox.com/SuperTool.aspx?action=mx:yourdomain.com

You should see the single JustEmails MX host and nothing else. Check SPF and DKIM too. If old records still appear, wait. DNS propagation is why we lowered TTL yesterday.

Send a test email from a personal Gmail or Outlook account to one of your migrated addresses. Verify it arrives in JustEmails.

Step 10: Run Delta Sync

Mail that arrived at iRedMail between your initial sync and MX cutover is still sitting on the old server. Run imapsync again:

imapsync \
  --host1 localhost --port1 993 --ssl1 \
  --user1 "ops@yourdomain.com" --password1 "iredmail-password" \
  --host2 mail.justemails.app --port2 993 --ssl2 \
  --user2 "ops@yourdomain.com" --password2 "justemails-password" \
  --automap

Same command as before. imapsync only copies new messages — it won't duplicate anything. This delta sync usually finishes in minutes.

Day 4: Client Reconfiguration and Verification

Step 11: Update Mail Clients

Your team's clients (Outlook, Apple Mail, Thunderbird, mobile apps) need new server settings:

Incoming (IMAP):

• Server: mail.justemails.app
• Port: 993
• Security: SSL/TLS
• Username: full email address
• Password: JustEmails password

Outgoing (SMTP):

• Server: mail.justemails.app
• Port: 587
• Security: STARTTLS
• Username: full email address
• Password: JustEmails password

Budget 10-15 minutes per person. Some folks are self-sufficient. Others need you standing behind them clicking the buttons. You know your team. (My least favorite part of any migration, if I'm being honest.)

Step 12: Recreate Aliases and Catch-Alls

iRedMail aliases don't transfer. In the JustEmails dashboard, recreate any aliases you need:

• sales@yourdomain.com → ops@yourdomain.com
• *@yourdomain.com → catch-all@yourdomain.com (if you use catch-alls)

Takes a few minutes. If you had complex Postfix alias rules, this is where you simplify. Most people discover they had aliases they forgot about and never actually used. (Why did we have support2017@? Who was that for? No one knows.)

Step 13: Keep iRedMail Running (7-14 Days)

Don't decommission iRedMail immediately. Some mail servers cache MX records aggressively — corporate Exchange servers are notorious for this. Keep iRedMail running for a week or two.

Run imapsync one more time at day 7. If it finds zero new messages across all mailboxes, you're clear. Shut down the VPS.

If you're on a $10/month Hetzner box, that's $5-10 of overlap. Cheap insurance against a misconfigured enterprise firewall that cached your old MX for a week.

The overlap has a second use. Outbound volume on the new host warms from the date the domain verified rather than the date you signed up — 20/day for the first week, 200/day for the second, 500/day from day 15 onward, counted per account rather than per mailbox, with the API drawing on the same total. If the domain normally pushes a few hundred messages a day, schedule the heaviest of it for after that fortnight.

Common Errors

imapsync fails with "Login failed"

Your iRedMail password is wrong. If you're using LDAP, check the bind credentials. If you're using MySQL, verify the password in vmail database matches what you're entering. Passwords with special characters sometimes need escaping in the shell.

Folders are missing or mangled

Dovecot's folder namespace might differ from what imapsync expects. Try adding --prefix1 "INBOX." to your imapsync command. That's the most common fix for iRedMail setups.

DKIM fails validation after cutover

CNAME propagation takes 15-60 minutes. The underscore in _domainkey trips people up — make sure it's je1._domainkey.yourdomain.com, not je1.domainkey.yourdomain.com.

Mail still arriving at iRedMail after cutover

DNS propagation isn't complete. If your old TTL was high, some resolvers are still caching. Wait it out and keep running delta syncs. This is why we lower TTL 24 hours before cutover.

What You're Trading

Let's be honest about what changes.

You lose: Direct SSH access to Postfix logs. The ability to tweak Rspamd scoring rules at the config level. Root on your own mail server.

You gain: Zero patching. No more Let's Encrypt renewal failures at 3 AM. No more babysitting IP reputation. No more checking Spamhaus every morning like it's the weather. Spam filtering with Rspamd and ClamAV that someone else maintains. Blacklist monitoring that someone else handles. You get your weekends back.

For some people — sysadmins who enjoy the craft, compliance-bound orgs needing data locality — self-hosting makes sense. For the r/selfhosted crowd running mail as a learning project, iRedMail is genuinely good.

But if email is a tool and not a hobby, and your time has value, $49/year for someone else to handle ops is the right trade. We compared the full TCO in our breakdown of managed hosting vs mailcow and Mail-in-a-Box.

Running multiple products and tired of per-seat sprawl across services? Velocity Digital Labs builds flat-fee tools for exactly this — JustAnalytics for web analytics, ClickzProtect for ad fraud monitoring, same philosophy. One price, unlimited usage.

The iRedMail box served you well. It taught you things. And now it's okay to move on.

Frequently Asked Questions

How long does migrating from iRedMail to JustEmails take?

Plan for 3-4 days total. Day 1 covers JustEmails setup and initial IMAP sync. Day 2 is TTL lowering on your DNS. Day 3 is MX cutover and delta sync. Day 4 is verification and client reconfiguration. Actual hands-on work is 2-3 hours spread across those days — the rest is waiting for DNS propagation and running imapsync in the background.

Will I lose emails during the iRedMail migration?

Not if you keep iRedMail running during the overlap. Run imapsync before MX cutover to grab historical mail, then run it again after cutover to catch anything that landed during the transition. Keep iRedMail alive for 7-14 days post-cutover as a safety net. Only shut it down once you've confirmed zero new mail arriving.

Do I need to export iRedMail's MySQL or LDAP data?

No. We're syncing mail over IMAP, not migrating the iRedMail database. Your mailbox contents, folder structure, and flags transfer via imapsync. User accounts get recreated manually in JustEmails — for most setups, that's 15 minutes of clicking. LDAP and MySQL stay on your old server until you decommission it.

What happens to my spam filter rules and aliases after migration?

Spam filter rules don't transfer — iRedMail uses Amavisd/SpamAssassin, JustEmails uses Rspamd. You'll start fresh with JustEmails' defaults, which are solid out of the box. Aliases and catch-alls need manual recreation in the JustEmails dashboard. Budget 5 minutes per domain if you have complex alias routing.

---

Try JustEmails

Unlimited custom domain email hosting for $49/year flat — unlimited domains, unlimited mailboxes, 10 GB storage, full IMAP/SMTP. Built for agencies, freelancers, and anyone managing email across more than one domain.

Start your 7-day free trial → · How it compares