From Exchange to Mailcow: how the migration works

This article is for the Exchange in your own server cabinet: Exchange Server 2016 or 2019, Active Directory next to it, Outlook on the desktops. If your mailboxes live in Microsoft 365, you want Migrating from Microsoft 365 to Mailcow — that one is about OAuth and throttling, this one is about IMAP services, firewalls and Autodiscover leftovers.

The situation in three sentences: regular support for Exchange 2016 and 2019 ended on October 14, 2025, the paid Extended Security Updates end on October 31, 2026, and Microsoft rules out a third period. The successor, Exchange Server SE, is only available with subscription licenses. On October 28, 2025, the German BSI counted more than 30,000 German Exchange servers running discontinued versions with open OWA and calls continuing to run them negligent. Which paths you have is covered in Exchange 2016/2019 end of support: your options compared. This article is about one of them: a mail server of your own on a Mailcow base — with us as Mailhosting or soon as your own Mailcow instance.

0. Preparation: inventory, IMAP, client check

Inventory from the Exchange Management Shell

Without a list, every move turns into a scavenger hunt. The Exchange Management Shell delivers it:

What	Cmdlet	Becomes in Mailcow
Accepted domains	Get-AcceptedDomain	one entry per domain (Mailhosting: one package per domain)
Mailboxes with size	Get-Mailbox, then Get-MailboxStatistics	mailbox with quota; if it does not fit the plan’s quota, see section 6
Distribution groups	Get-DistributionGroup	alias with several targets
Aliases and forwards	Get-Mailbox with EmailAddresses and ForwardingAddress	aliases or Sieve forwarding
Shared mailboxes, room mailboxes	Get-Mailbox -RecipientTypeDetails SharedMailbox,RoomMailbox	regular mailbox or shared calendar
Public folders	Get-PublicFolder -Recurse	do not exist — contents go into an archive mailbox
Devices relaying through Exchange	receive connector logs, scanners, ERP, monitoring	one mailbox per device with an app password

The last row is the typical Monday-morning case after the move: the scanner stops scanning because Mailcow only accepts authenticated sending on port 587 — see App passwords.

Enabling IMAP on Exchange

Exchange ships with IMAP; out of the box the service is off. In the Exchange Management Shell:

Set-Service MSExchangeIMAP4 -StartupType Automatic
Set-Service MSExchangeIMAP4BE -StartupType Automatic
Start-Service MSExchangeIMAP4
Start-Service MSExchangeIMAP4BE
Set-ImapSettings -ExternalConnectionSettings "mail.firma.de:993:SSL" -X509CertificateName mail.firma.de

Then restart both services, enable the certificate for IMAP (Enable-ExchangeCertificate -Services IMAP) and open port 993 on the firewall from the outside — our server has to reach your Exchange, not just your LAN. Test: Thunderbird from outside against port 993. If that works, the sync job works too.

Client check — before the move, not after

Mailcow speaks IMAP, SMTP, CalDAV and CardDAV. No MAPI, so no desktop Outlook in Exchange mode. ActiveSync no longer works with Outlook 2019 and newer, Microsoft 365 or the new Outlook, and SOGo is dropping ActiveSync in 2026. Outlook on Windows runs via IMAP/SMTP, calendar and contacts through the CalDav Synchronizer plugin. Fully covered: webmail (SOGo), Apple Mail on iPhone, iPad and Mac, Android, Thunderbird and eM Client.

What there isn’t: shared mailboxes in the Exchange sense, room booking, server-side Outlook rules as in Exchange — Sieve filters do exist. If your team depends on one of these points, now is the moment to settle it. Overview: Which mail client fits you?

1. Preparing Mailcow

Domains. With Mailhosting we set up your domain with the order — one plan, one domain (several domains: see the questions below).

Mailboxes. Same local parts as on Exchange, quota from the inventory plus some headroom — instructions in Creating mailboxes.

Aliases and distribution lists. An Exchange distribution group becomes an alias with several targets; enable “public distribution list” only if outsiders are allowed to write to the address. A shared mailbox becomes a regular mailbox with its own password whose folders you share in SOGo. Forwards to the outside become aliases to external addresses. All of it in Aliases and catchall.

Devices. Scanners, ERP, monitoring: one mailbox each (scanner@) with an app password and the values from the server details reference.

2. Initial sync via sync job

In the mailbox backend under E-Mail → Configuration, tab Sync Jobs — the same IMAP migration tool as in the other migration articles, imapsync under the hood. One job per mailbox:

Field	Value
Host	FQDN of your Exchange, e.g. mail.firma.de
Port, encryption	993, SSL
Username	UPN (vorname@firma.de); some setups want FIRMA\vorname
Password	the user’s AD password
Interval	leave the default; active until cutover day
Maximum age	0, otherwise old years are missing
Delete messages on source	off

The job only copies what is missing — it can run as often as you like. Two ways to handle the password: the admin sets passwords for the migration phase that users change afterwards — or you enable the “Sync Jobs” permission in the mailbox and everyone enters their own job. From a handful of people upwards, we take the second.

What comes along: all mails with their original date, the folder structure, read/unread, answered, flagged. What does not come along: Outlook categories, follow-up flags with due dates, notes, tasks, rules and out-of-office notices — those are MAPI properties, not IMAP flags. Rough figures on duration are in the Microsoft 365 article; old Exchange hardware tends to be slower.

3. Calendars and contacts

Calendars: in Outlook, open the calendar view, then per calendar File → Save Calendar (iCalendar format, .ics). Before that, under “More options” set the date range to “Whole calendar” and the detail level to “Full details” — otherwise Outlook exports only free/busy. Import into SOGo: SOGo calendar. Sharing does not come along; shared calendars you share again in SOGo. A room mailbox becomes a shared calendar that one person maintains.

Contacts: export from Outlook as vCard (.vcf), import into SOGo — SOGo takes vCard, not CSV. Steps in SOGo contacts. The global address list is replaced by a shared address book in SOGo that everyone subscribes to.

4. DNS in the right order

You get the concrete values from us with the setup. The order is up to you:

Step	Record	When
1	TTL of MX, SPF and Autodiscover down to 300 seconds	at least one day before the switch
2	SPF with both senders: Exchange IP and our include	before the switch
3	DKIM selector from Mailcow	before the switch
4	DMARC — if new, start with p=none; after the move p=quarantine	before the switch
5	MX to our server	cutover day, in the evening
6	autoconfig and autodiscover as CNAME to our server; remove the SRV record _autodiscover._tcp that points to the Exchange	cutover day
7	Exchange IP out of the SPF	after shutdown

Steps 2 to 4 before the MX switch have a reason: you are already sending from Mailcow and see spf=pass, dkim=pass, dmarc=pass in the headers of a test mail before a single customer mail takes the new route — how to check that is in Building mail reputation.

5. Remaining sync and cutover day

1. Switch the MX in the evening. The TTL was lowered; after a few minutes new mail lands at Mailcow.
2. Keep the sync jobs running. Stragglers from old DNS caches still arrive at Exchange; the jobs fetch them.
3. Switch the clients. Outlook: new profile as an IMAP account plus CalDav Synchronizer — instructions. iPhone and iPad via configuration profile: Apple Mail iOS. Android: K-9 / Thunderbird Mobile. Desktop without Outlook: Thunderbird.
4. Exchange as a read-only copy for two weeks. Services running, port 25 and OWA (443) closed from the outside on the firewall, 993 stays open for the sync jobs, nobody works on it anymore — whoever misses something finds it there.
5. Shut down. Delete the sync jobs first — otherwise they run into nothing and fill your log. Then stop the services, power off the server, keep the last backup. The clean uninstall from Active Directory is a project of its own, not a footnote.

6. Typical pitfalls

IMAP off or port 993 closed. The typical reason for “connection failed” in the first sync job. Test from outside, not from the LAN.

Mailboxes larger than the plan’s quota. Check the plan’s quota, offload old years as PST or put them in an archive mailbox, let the sync run overnight.

Umlauts in folder names. “Geschäftspost” comes out of Exchange in IMAP UTF-7 and looks odd after the sync. Rename without umlauts before the sync or rename in Mailcow afterwards — details in the IMAP migration article.

Distribution list as a SOGo list instead of an alias. A list in the SOGo address book is an entry for you — outsiders cannot write to it. Everything that should be reachable from outside is an alias.

Reputation of the new sending IP. Your domain has history, the IP is new to the recipients. No bulk mail in the first week; warm up according to Building mail reputation.

Bending Outlook profiles. A domain-joined Outlook finds the old Exchange through the SCP entry in Active Directory as long as the server is running. That is why you create a new profile instead of rebuilding the account; the mails are on the server, nobody needs the old OST file.

Autodiscover leftovers and duplicate SPF records. Two TXT records with v=spf1 are an error, not double safety. And a forgotten SRV record keeps sending clients to the old server months later.

7. What we can take over

You don’t want to do this yourself? Then open a ticket with the inventory and the mailbox count. We create sync jobs and aliases, build the DNS plan, accompany the cutover day and check SPF, DKIM, DMARC and delivery afterwards. PST imports we do assisted as well. Billing is by effort, which we calculate up front — as stated on the Mailhosting page.

Frequently asked questions

Can I move the mailboxes via PST instead of IMAP? Yes. Open the PST in Outlook, the new IMAP account next to it, drag the folders across. Fine for two mailboxes; with many, you use sync jobs — or we do it assisted.

We also use Teams, SharePoint and Office — does Mailcow replace that? No. Mailcow replaces Exchange, not Microsoft 365. Nextcloud Server gets you further: Euro-Office in the browser on the proven OnlyOffice engine with high MS Office compatibility, Talk for chat and video (with the Talk HPB for up to 50 concurrent Talk users), calendar, contacts, whiteboard. Not replaced: Word, Excel and PowerPoint as desktop programs, Teams telephony and Teams apps, SharePoint workflows, Power Automate, Intune and Entra ID features.

How long may the old Exchange keep running? As a read-only copy for two weeks, then off. Without purchased ESU it has been running unpatched since October 2025; with ESU, October 31, 2026 is the end — an unpatched Exchange with open OWA is exactly what the BSI calls negligent.

We have three domains — does that work? With Mailhosting it is one package per domain. Several domains on one server are available as the Mail Server — your own Mailcow instance with its own sending IP; we handle the move there as a fixed-price package by mailbox count, free of charge up to and including January 31, 2027.