DevOps · 25 October 2026 · 7 min read
Moving company email off Google Workspace to your own server: a practical guide
We recently moved the email of three company domains from Google Workspace and an old server onto one self-hosted mail server. Here is the order of steps that kept every inbox working during the switch.
Why companies move away from Google Workspace
Cost per user adds up, data stays with a third party, and every new domain or mailbox is another subscription. A self-hosted server can host many domains and as many mailboxes as you need on one machine.
The trade-off is responsibility: you now own deliverability, security, backups and updates. That is fine if someone looks after it, and risky if nobody does.
The stack we used
We used docker-mailserver, which bundles everything a production mail server needs in one container, plus Roundcube as webmail.
- Postfix and Dovecot for sending and mailboxes
- Rspamd for spam filtering and DKIM signing
- ClamAV and Fail2ban for viruses and brute-force attacks
- Roundcube webmail with a familiar, Gmail-like interface
- An SMTP relay for outgoing mail, because many hosting providers block port 25
Migrate mailboxes before you touch DNS
First import the old email: a Google data export or IMAP sync for Workspace, and a file-level copy for an old server. Keep flags such as read and starred, and folder structure, so users find everything where they left it.
If you copy users from an old Linux server, the password hashes can often move too, so nobody has to reset their password on switch day.
Get deliverability right
New mail servers land in spam when authentication is missing. Before the switch, set up and test:
- SPF listing every server and relay that sends for the domain
- DKIM keys per domain, published in DNS
- DMARC with reports sent to a dedicated mailbox
- A reverse DNS (PTR) record that matches the server hostname
- A real test: send to Gmail and check that SPF, DKIM and DMARC all pass
The cutover
Lower the DNS TTL a day before. Then point the MX record (or the mail hostname) to the new server, stop delivery on the old one so senders retry against the new address, and run a final delta sync for anything that arrived in between.
Email is forgiving here: a sending server that cannot connect retries for days, so a few minutes of switching do not lose messages.
After the switch
Check the dependencies people forget: apps that send through the old account, logins that used "Sign in with Google", DNS verification records and transactional email providers. Then remove the old records and cancel the subscription.
FAQ
- Is self-hosted email reliable?
- Yes, if it is maintained. A modern stack such as docker-mailserver with SPF, DKIM, DMARC, spam filtering, monitoring and daily backups is reliable. The risk is an unmaintained server, not the software.
- Will my emails go to spam after moving?
- Not if authentication is complete. Publish SPF, DKIM and DMARC, set a matching reverse DNS record, send through a reputable relay if your host blocks port 25, and test delivery to Gmail before switching.
- Can several domains share one mail server?
- Yes. One server can host many domains, each with its own mailboxes, DKIM key and webmail address.