Moving email is solved. Deliverability is not.

Of all the building blocks of a workplace, email is the best solved. The protocol is over thirty years old, open, and every provider can talk to every other. Migrating mailboxes is craft work: synchronisation runs in the background, you start with a cooperative department, and the MX record changes last.

The risk sits elsewhere, and it appears in no vendor brochure.

Reputation does not move with you

Whether your mail arrives is decided not by your provider but by the recipient's. And that provider judges what it knows about your sending domain and infrastructure: how long has it been sending? How many recipients marked messages as spam? Do the technical records line up?

After a switch, the answer to the first question is: since yesterday. With some large providers that is enough to put messages under quiet scrutiny — delayed delivery, or straight into the promotions folder.

If that happens to hit the quote going to your most important customer, you are no longer discussing sovereignty. You are discussing revenue, and the project is over.

The three records that must be right first

SPF declares which servers may send for your domain. The most common migration mistake: the old provider stays in the record, the new one is added, and eventually there are so many entries that the check fails on a technical limit.

DKIM signs outgoing messages. The key belongs to the provider — a switch creates a new one, and the old one may only be removed once nothing at all still leaves through the old path.

DMARC ties the two together and tells recipients what to do on mismatch. Start in pure monitoring mode, read the reports for two weeks, and only tighten afterwards. Going straight to reject reliably blocks your own accounting software, your recruiting portal and your newsletter service — all systems that send in your name and that nobody remembers during a migration.

That list is the real return on the preparation: for the first time you learn in full who sends email as you.

What is on the table

mailbox.org, Posteo and Tuta (all Germany) are well-considered subscription products with different emphases. Tuta encrypts most consistently and is for exactly that reason the least convenient over classic IMAP — a fair trade, as long as you know about it.

Infomaniak and Migadu (Switzerland) sit outside the EU, under an adequacy decision.

Open-Xchange (Germany) pays off when many mailboxes and your own administration are involved.

Mailcow (Germany) is the choice for self-hosting — but only if somebody in the building will also maintain it. Running mail yourself is technically feasible and organisationally demanding: blocklists, certificates, updates, and occasionally a weekend.

The archive

The part most underestimated in a migration is the historical mail. Fifteen years of correspondence is legally relevant, practically valuable and technically awkward.

Two rules suffice. The archive sits in your own hands before cut-over, not with the old provider. And it sits in a format readable without that provider.

Fail either and you have not switched providers, you have merely relocated the hostage. The same applies to retention duties: an audit-proof archive that only the old interface can read satisfies the duty on paper and helps you not at all in an incident.

The schedule

Preparing records and taking inventory of sending systems: one week. First department: another. Full cut-over for a hundred mailboxes: four to six weeks including follow-up.

And in the week before the MX change, deliberately send little marketing. Reputation is built with ordinary business correspondence, not with a newsletter to eight thousand addresses.