How to Migrate from Amazon WorkMail in Under 10 Minutes

Migration doesn't have to be painful

Email migrations have a reputation for being stressful, time-consuming, and risky. We built inbox.camp's migration specifically to change that. If you're currently on WorkMail, here's exactly what the process looks like.

Before you start

You'll need:

• An AWS account with an IAM user or role that has admin access (the same account running WorkMail)
• About 10 minutes
• That's it

Step 1: Connect your AWS account (~2 minutes)

Sign up at inbox.camp and click "Connect AWS Account." We use a CloudFormation stack to create a scoped IAM role in your account. This role gives inbox.camp the minimum permissions needed to manage email on your behalf:

• SES — send and receive email
• S3 — store email data
• Route 53 — manage DNS records
• WorkMail (read-only) — detect your existing setup

One click deploys the stack. No YAML editing. No CLI commands.

Step 2: Auto-detect WorkMail setup (~1 minute)

Once connected, inbox.camp automatically scans your WorkMail organizations. We detect:

• Your WorkMail organizations and their regions
• All verified domains
• All users and their email addresses
• Aliases and distribution groups
• Current DNS configuration

You'll see a summary of everything we found. Review it, confirm it looks right, and move to the next step.

Step 3: Create mailboxes (~2 minutes)

inbox.camp pre-fills user accounts based on your WorkMail users. You can:

• Keep all users as-is
• Remove users you no longer need
• Add new users
• Set up aliases and catch-all addresses

Each user gets a temporary password they'll change on first login. Or you can set passwords manually.

Step 4: Cut over DNS (~3 minutes)

This is the big moment. inbox.camp updates your Route 53 records to point to our mail infrastructure:

• MX records — point to inbox.camp's mail servers
• SPF — updated to authorize SES
• DKIM — new keys generated and verified
• DMARC — configured with your policy preference

DNS propagation for Route 53 is fast — usually under 60 seconds for the zones you control. External caches may take longer, but incoming mail will start flowing to inbox.camp within minutes.

Step 5: Start reading email (immediately)

Once DNS is cut over:

• Open the inbox.camp web UI and log in
• Or configure your email client (Outlook, Apple Mail, Thunderbird, iOS Mail, Android) with your new IMAP/SMTP credentials
• New incoming mail arrives in inbox.camp

What about old emails?

WorkMail stores email in its own backend, which isn't directly accessible via S3. There are two approaches to preserving old mail:

1. IMAP sync (recommended): Before cutting over DNS, use an IMAP migration tool to copy existing mail from WorkMail to inbox.camp. This preserves your full email history.
2. Keep WorkMail running briefly: You can access old WorkMail emails while your inbox.camp account handles new mail. Gradually, your old mail becomes less relevant.

We're building an automated IMAP sync tool that will handle option 1 with one click. It'll be ready before WorkMail shuts down.

What if something goes wrong?

DNS changes are reversible. If anything looks off, inbox.camp can revert your MX records to point back to WorkMail in seconds. Your old WorkMail setup continues to work until you decommission it.

We also keep a full audit log of every change made during migration, so you can see exactly what happened and when.

Ready to migrate?

We're launching Summer 2026 — well ahead of the March 2027 WorkMail shutdown. Join the waitlist and we'll let you know when migration is ready. Early access users get priority onboarding and direct support from our team.