Amazon WorkMail Alternative: How to Migrate to JustEmails Without Losing Mail

AWS is ending WorkMail support on 31 March 2027. If your team's mail lives there, the move is mandatory—not optional, not someday, but before that date. The good news: you can migrate cleanly and without losing a single message, because WorkMail supports standard IMAP, the same protocol every mail client uses. That makes it one of the easiest providers to leave.

This guide walks you through a proper migration. You'll copy all your mail via imapsync, cut over your DNS (MX, SPF, DKIM) without downtime, and keep WorkMail running for 30 days as a safety net. By the end, your team's mail is elsewhere, your addresses are the same, and the AWS bill finally doesn't say "WorkMail" on it.

We're the JustEmails team — built by Velocity Digital Labs, the same folks behind JustAnalytics and ClickzProtect.

What You'll Have at the End

A fully working email setup on JustEmails: all historical mail migrated, all mailboxes receiving new mail, SPF/DKIM/DMARC configured, and WorkMail switched off ahead of its end of support. Your team keeps the same addresses and folders, with standard IMAP access; the server settings in their mail apps change (Step 12).

Prerequisites

Before starting, gather:

• AWS console access with WorkMail admin permissions
• DNS access (Route 53, Cloudflare, or wherever your nameservers point) — if you need a refresher on DNS basics, check our custom domain email setup guide
• A JustEmails account — start the 7-day free trial if you haven't (wondering how we compare to other providers? See our Google Workspace alternatives guide)
• A Linux or macOS machine with imapsync installed (a small cloud VPS works — you can spin it down after)
• WorkMail passwords for each user (or the ability to reset them)

Two JustEmails limits to plan around. The 7-day trial allows 1 domain, 2 mailboxes and 1 GB of storage, so a multi-user migration needs the paid plan before the bulk sync. And the included 10 GB of storage is shared across every mailbox on the account, so add up what your WorkMail users currently store before you start.

One thing that trips people up: WorkMail uses the AWS region in its IMAP hostname. You'll need to know which region your WorkMail organization lives in. Check the WorkMail console URL — if it says us-east-1.console.aws.amazon.com/workmail, your IMAP server is imap.mail.us-east-1.awsapps.com. A wrong region shows up as "connection refused" or a timeout.

Step 1: Create Mailboxes in JustEmails

Log into JustEmails. Add your domain if you haven't already — the dashboard walks you through verification with a TXT record. Then create a mailbox for every user you're migrating. Match the addresses exactly: if someone's james@yourcompany.com in WorkMail, create james@yourcompany.com in JustEmails.

Don't touch MX records yet. We're setting up the destination, not cutting over.

JustEmails gives you IMAP credentials for each mailbox. Save them somewhere — you'll need them for imapsync.

Step 2: Get WorkMail IMAP Credentials

imapsync signs in to WorkMail the way any IMAP client does: with each user's full email address and their WorkMail password. If you don't know a user's password, reset it before you start.

The IMAP server hostname follows this pattern:

imap.mail.REGION.awsapps.com

Replace REGION with your WorkMail region (us-east-1, us-west-2, eu-west-1, etc.). Port 993, SSL/TLS.

Step 3: Install imapsync

imapsync copies mail between any two IMAP servers. It preserves folder structure, read/unread flags, and dates. On Ubuntu/Debian:

sudo apt update && sudo apt install imapsync

On macOS with Homebrew:

brew install imapsync

Verify it works:

imapsync --version

You want version 2.x or higher.

Step 4: Run the Initial Bulk Sync

Here's the command template. Replace the placeholders:

imapsync \
  --host1 imap.mail.us-east-1.awsapps.com --port1 993 --ssl1 \
  --user1 "james@yourcompany.com" --password1 "workmail-imap-password" \
  --host2 mail.justemails.app --port2 993 --ssl2 \
  --user2 "james@yourcompany.com" --password2 "justemails-password" \
  --automap

The --automap flag handles folder name differences between servers. WorkMail uses standard IMAP folder names, so this usually just works.

Run this for every mailbox. For multiple users, a bash loop helps:

while IFS=, read -r user wmpass jepass; do
  imapsync \
    --host1 imap.mail.us-east-1.awsapps.com --port1 993 --ssl1 \
    --user1 "$user" --password1 "$wmpass" \
    --host2 mail.justemails.app --port2 993 --ssl2 \
    --user2 "$user" --password2 "$jepass" \
    --automap
done < users.csv

CSV format: email,workmail_password,justemails_password. Not elegant, but it gets the job done.

If you're migrating 30+ mailboxes, you can run several imapsync processes in parallel. Keeping it to 5-6 at a time keeps the output easy to follow.

First sync takes time. A 3GB mailbox can take an hour or two. Let it run. imapsync is resumable — if it crashes, run the same command again and it picks up where it left off.

Step 5: Lower DNS TTL

Before changing MX records, drop the TTL on your existing records. If your TTL is 86400 seconds (24 hours), mail servers will cache the old MX for a full day after you update. That's a day of mail going to the wrong place.

In Route 53 or Cloudflare:

1. Find your MX records
2. Edit each one and set TTL to 300 (5 minutes)
3. Save

Wait 24-48 hours. The old TTL needs to expire everywhere before the new short TTL kicks in.

Boring. Absolutely necessary.

Step 6: Prepare JustEmails DNS Records

While waiting on TTL, grab the DNS records from JustEmails. In your domain settings, you'll see:

• MX record (a single host pointing at the JustEmails mail server)
• SPF record (a:mail1.justemails.app)
• DKIM records (TXT records at dkim._domainkey and arc._domainkey, with a key unique to your domain)
• DMARC (if a _dmarc record already exists, edit it rather than adding a second)
• A verification TXT record and the MTA-STS records

Screenshot or write these down.

Step 7: Update MX Records

Time for the cutover.

Delete WorkMail's MX record. It looks like:

inbound-smtp.us-east-1.amazonaws.com (priority 10)

(The region varies. Check your current records.)

Add the JustEmails MX record. There is only one — a single host, one priority:

mail1.justemails.app (priority 10)

Check your JustEmails dashboard for exact values.

Step 8: Update SPF

Your WorkMail SPF record probably includes:

v=spf1 include:amazonses.com ~all

Change it to:

v=spf1 a:mail1.justemails.app ~all

That a: mechanism authorises whatever IP mail1.justemails.app resolves to. There is no JustEmails include to add — spf.justemails.app and _spf.justemails.app carry no TXT record, so an include pointing at either authorises nothing while still looking correct in a DNS panel.

If you're still using SES for transactional email (separate from mailbox hosting), keep the SES include alongside it:

v=spf1 a:mail1.justemails.app include:amazonses.com ~all

One SPF record only. Multiple SPF records break validation. Period. (If you're running into SPF errors, our guide on fixing SPF permerror and too many includes covers the common fixes.)

A common way to end up with two: one left over from the WorkMail setup and another added by a marketing tool. If a record already exists, edit it rather than adding a second. DNS panels make duplicates weirdly easy to create, so check twice.

Step 9: Replace DKIM Records

Delete WorkMail's DKIM CNAME records. They're usually something like:

[selector]._domainkey.yourcompany.com → [selector].dkim.amazonses.com

Add the JustEmails DKIM records. These are TXT records, not CNAMEs, and the key is unique to your domain, so copy the value from your dashboard:

dkim._domainkey.yourcompany.com   TXT   "v=DKIM1; k=rsa; p=…"
arc._domainkey.yourcompany.com    TXT   "v=DKIM1; k=rsa; p=…"

The arc record uses the same key and signs forwarded mail. The underscore in _domainkey is important. It's part of the subdomain name, not a typo.

Step 10: Verify DNS Propagation

Check with MXToolbox:

https://mxtoolbox.com/SuperTool.aspx?action=mx:yourcompany.com

You should see the JustEmails MX host, mail1.justemails.app, and nothing else. Check SPF and DKIM too. If anything shows old AWS records, wait longer.

Send a test email from an external account (personal Gmail, Outlook, whatever) to one of your migrated addresses. Verify it arrives in JustEmails, not WorkMail.

Step 11: Run Delta Sync

Mail that arrived at WorkMail between your initial sync and the MX cutover is still sitting in WorkMail. Run imapsync again:

imapsync \
  --host1 imap.mail.us-east-1.awsapps.com --port1 993 --ssl1 \
  --user1 "james@yourcompany.com" --password1 "workmail-imap-password" \
  --host2 mail.justemails.app --port2 993 --ssl2 \
  --user2 "james@yourcompany.com" --password2 "justemails-password" \
  --automap

Same command as before. imapsync only copies new messages — it won't duplicate existing ones. This delta sync usually finishes in minutes.

Step 12: Update Mail Clients

Your team's mail clients need new server settings:

Incoming (IMAP):

• Server: mail.justemails.app
• Port: 993
• Security: SSL/TLS
• Username: full email address
• Password: JustEmails password

Outgoing (SMTP):

• Server: mail.justemails.app
• Port: 587
• Security: STARTTLS
• Username: full email address
• Password: JustEmails password

Outlook, Apple Mail, Thunderbird, mobile apps — all of them. Budget 10-15 minutes per person for the ones who need hand-holding. (Budget 45 minutes for That One Person who insists their settings are correct when they're clearly not. Every team has one.)

Step 13: Keep WorkMail Active (30 Days)

Don't cancel WorkMail immediately. Some mail servers hold on to old MX records longer than they should. Keep WorkMail running for 30 days.

Run imapsync delta syncs at day 7, day 14, and day 28. On day 30, log into the WorkMail console, verify mailboxes show no new mail, and delete the organization.

Spend part of that month on the outbound side too. A newly verified domain sends no more than 50 a day in the first week, 200 in the second, and up to 500 from day 15 — counted across the whole account, with mailbox sends and API sends drawing on the same daily allowance. If anything in your stack has been mailing at volume, the 30-day window is the room you have to check its real daily number against that.

Start early enough that the 30 days finish well before 31 March 2027. Then watch the WorkMail line disappear from your AWS bill.

Common Errors and Fixes

"NO AUTHENTICATE" error in imapsync

Wrong username or password on one side. WorkMail expects the full email address and the user's WorkMail password; JustEmails expects the full email address and the mailbox password. Reset the password on whichever side you're unsure of.

"Connection refused" or "Connection timed out"

Wrong region in the IMAP hostname. Double-check your WorkMail region. The hostname is imap.mail.REGION.awsapps.com — if you're in us-east-1, it's imap.mail.us-east-1.awsapps.com.

SPF fails validation after cutover

Either you have multiple SPF records (delete all but one) or the amazonses.com include is still there without a:mail1.justemails.app alongside it. Use dig yourcompany.com TXT or MXToolbox to see exactly what's published.

DKIM shows as "missing" in MXToolbox

DNS changes usually show within minutes and can take a few hours. Check that you added TXT records (not CNAMEs) with the full key copied from your dashboard, and double-check the record names — the underscore in _domainkey is part of the subdomain, not decoration.

Mail still arriving at WorkMail after cutover

DNS propagation isn't complete. Keep WorkMail active, keep running delta syncs. Some corporate mail servers cache MX records for 48+ hours even with short TTLs.

What You'll Pay After Migration

Once you've moved to JustEmails, here's what the ongoing email hosting costs. JustEmails is $49 a year, flat, for unlimited custom domains and unlimited mailboxes with a unified inbox across all of them — additional team members are $2 per member per month, and storage beyond the included 10 GB is $99 a year per 100 GB.

A mailbox isn't a team member: each person gets a mailbox at no extra cost, and only extra people who need their own JustEmails dashboard login are billed. WorkMail charged per user, so check AWS's current pricing page and multiply by your headcount before comparing. Per-mailbox models get more expensive with every hire; this one doesn't charge per mailbox. For a deeper dive into email hosting costs, see our business email pricing survey 2026 and flat-fee vs per-mailbox pricing comparison.

And you stop managing email settings through the AWS console. Worth a weekend.

Frequently Asked Questions

Why do I need to move off Amazon WorkMail?

AWS has stopped taking new WorkMail customers and ends WorkMail support on 31 March 2027, per its end-of-support page. Mail hosted there needs a new home before that date. JustEmails is $49/year flat with unlimited mailboxes.

Can I migrate WorkMail to JustEmails without losing email?

Yes. WorkMail supports standard IMAP, so you can use imapsync to copy all mail to JustEmails before cutting over MX records. Keep WorkMail active for 30 days after the cutover and run delta syncs to catch any stragglers. Follow that order and no mail should be lost.

Do I need to stay in AWS for DNS after migrating?

No. If your DNS is in Route 53, you can either update records there or move DNS to Cloudflare or another provider entirely. JustEmails doesn't require AWS for anything. Moving DNS away from AWS is optional but simplifies billing if you're trying to exit the AWS ecosystem completely.

Will my SPF and DKIM records change?

Yes. Your SPF record swaps the amazonses.com include for JustEmails' mechanism, which is a:mail1.justemails.app — an a: mechanism, not an include. DKIM keys are provider-specific — WorkMail's CNAME records get replaced with JustEmails DKIM records. JustEmails auto-generates these, so it's copy-paste into your DNS panel. For full DMARC setup after migration, see our DMARC p=reject guide.

---

Try JustEmails

Unlimited custom domain email hosting for $49/year flat — unlimited domains, unlimited mailboxes, 10 GB storage, full IMAP/SMTP. Built for agencies, freelancers, and anyone managing email across more than one domain.

Start your 7-day free trial → · How it compares