Will any mail bounce during the cutover?

No, if you follow the overlap plan. Both Workspace's MX and Emcognito's MX accept inbound for the domain during the transition window; senders that resolve either receiver will deliver. Once the MX swap propagates fully, mail flows only to Emcognito.

Do I need to move my existing Workspace mailbox archive?

No. The migration covers DNS only — Emcognito starts receiving new mail at cutover. Your historical Gmail archive stays in Workspace (export it via Google Vault or Takeout if you want a local copy) and is not affected by the DNS change.

How long until I can cancel Workspace?

Plan for about seven days of overlap. After a week with no mail arriving at Workspace's MX (you'll see this in Admin Console traffic stats), it's safe to downgrade or cancel the subscription.

What about other domains aliased onto my Workspace tenant?

Each aliased domain needs its own MX change and its own Emcognito binding. The plan on this page is per-domain; repeat the four-record DNS swap for each one before cancelling Workspace.

Does this work if I use a third-party MX-routing layer like Mailgun or Cloudflare Email Routing?

Yes. The MX records you publish point at Emcognito's inbound server; any routing layer that previously pointed at Google's ASPMX records gets re-pointed at Emcognito or removed. See the registrar-specific notes below.

Dept. of migrations · Google Workspace → Emcognito

Move in ten minutes.
Without losing a letter.

A printed-out plan for migrating one domain off Google Workspace into Emcognito WebMail. Mail keeps flowing through Workspace until you flip the MX in Stage II — and Workspace stays receiving for about a week after that as a quiet safety net.

Type your domain below. The DNS records re-render to your domain in place. Copy them into your registrar in the order on this page. Total hands-on work is roughly ten minutes; the rest is waiting on DNS to propagate.

Updated 11 May 2026 (2026-05-11)

Proof of move · enter once, used throughout

Domain — required

Registrar

Preflight · before we start

Lower the TTL.
Keep your nerve.

The actual cutover takes seconds — you delete one MX row and add another. The slow part is DNS propagation: the world's resolvers cache your old MX for as long as the TTL says they may. If your current MX TTL is set to a day, a misclicked cutover will haunt you for a day.

Lower the TTL on your existing Workspace MX records to 300 seconds at least an hour before you plan to cut over. That's your rollback insurance: if anything misbehaves after Stage II, reverting takes five minutes instead of twenty-four hours.

i Open your registrar (Cloudflare). Find the MX records for your-domain.com.
ii Lower the TTL on every existing Workspace MX row to 300. Save.
iii Wait an hour. Have a coffee. Continue to Stage I.

Stage I · no downtime · safe at any time

Add Emcognito's three records.

Publish these alongside your existing Workspace records. Mail keeps flowing through Workspace; nothing changes for senders or recipients. You're laying down the new track next to the old one.

№ 01MX
Host
your-domain.com
Value
10 inbound.wm.emcognito.com
The world's mail servers learn that mail for this domain belongs at Emcognito's inbound MTA. Priority 10 — there's no backup, the MTA is the single authoritative receiver.
№ 02TXT
Host
your-domain.com
Value
v=spf1 include:emcognito.com ~all
SPF — authorize Emcognito's outbound IPs to send mail on this domain's behalf. The soft-fail (~all) is intentional; DMARC below is what enforces.
№ 03TXT
Host
_dmarc.your-domain.com
Value
v=DMARC1; p=reject; sp=reject; adkim=s; aspf=r; rua=mailto:dmarc@emcognito.com
DMARC with strict DKIM alignment — reject anything not properly signed. Aggregate reports go to dmarc@emcognito.com; Emcognito owns the external reporting authorization, so do not add a separate _report._dmarc record.

Stage II · the cutover · about five minutes

Replace Workspace's MX.

You added Emcognito's MX in Stage I. It sits there inert until Workspace's MX rows are gone — whichever resolves first wins, and Workspace's lower-priority entries currently win every time. Now you remove Workspace's rows and the new MX takes over the moment caches refresh.

Delete these from the MX records on your-domain.com

1 SMTP.GOOGLE.COM
1 ASPMX.L.GOOGLE.COM
5 ALT1.ASPMX.L.GOOGLE.COM
5 ALT2.ASPMX.L.GOOGLE.COM
10 ALT3.ASPMX.L.GOOGLE.COM
10 ALT4.ASPMX.L.GOOGLE.COM

Stage III · cleanup · do this in a week

Wait a week.
Then cancel.

Workspace continues to receive mail for a few days after the MX flip — every cached resolver eventually refreshes, but stragglers may still hit Workspace for up to a week. Don't cancel until that tail is gone. Look at the Workspace inbox occasionally; once it's been three days since the last delivery, you're clear.

Watch the Workspace inbox for ~7 days. Forward anything important to your new Emcognito address.
Cancel the Workspace subscription in Admin · Billing · Subscriptions.
If other tools (transactional senders, marketing platforms) were authorised via Workspace's SPF, update their SPF entries. Emcognito's SPF on your-domain.com already covers Emcognito's own outbound; everything else needs its own includes.

Open the first letter

Bind your-domain.com
to Emcognito.

The plan above gets you onto Emcognito's MX. The signup adds your DKIM key and proves the domain to SES so outbound starts signing properly — that part takes about as long as the registrar changes did, probably less, because the wizard pre-fills everything based on the records you've already published.

Set up your domain →See what it costs

No card needed. The first domain you bind and the first 25 sends are free; the 14-day card trial begins only when you want to bring more domains under one roof.

Common questions

Questions migrators ask.

Will any mail bounce during the cutover?: No, if you follow the overlap plan. Both Workspace's MX and Emcognito's MX accept inbound for the domain during the transition window; senders that resolve either receiver will deliver. Once the MX swap propagates fully, mail flows only to Emcognito.
Do I need to move my existing Workspace mailbox archive?: No. The migration covers DNS only — Emcognito starts receiving new mail at cutover. Your historical Gmail archive stays in Workspace (export it via Google Vault or Takeout if you want a local copy) and is not affected by the DNS change.
How long until I can cancel Workspace?: Plan for about seven days of overlap. After a week with no mail arriving at Workspace's MX (you'll see this in Admin Console traffic stats), it's safe to downgrade or cancel the subscription.
What about other domains aliased onto my Workspace tenant?: Each aliased domain needs its own MX change and its own Emcognito binding. The plan on this page is per-domain; repeat the four-record DNS swap for each one before cancelling Workspace.
Does this work if I use a third-party MX-routing layer like Mailgun or Cloudflare Email Routing?: Yes. The MX records you publish point at Emcognito's inbound server; any routing layer that previously pointed at Google's ASPMX records gets re-pointed at Emcognito or removed. See the registrar-specific notes below.

Sources & further reading