Migrate

Moving mail off Google Workspace

Domain-wide delegation, one token per mailbox, and the labels-are-folders problem handled where it matters.

Read this part first

What this connector cannot do. These are the facts that decide how long your weekend is.

Labels become folders, and a message with several labels lands in several folders. Gmail’s model is not IMAP’s, and no migration reconciles them perfectly. Expect duplicates where labels overlapped.
Calendar and contacts are not migrated, and MailDock does not serve them. It is a mail server. Calendars and contacts would need a separate service, which we have not built — plan for them elsewhere before you move.
A filter that decides where a message lands must translate exactly, or it is refused. Refused: Gmail search queries (has:attachment, older_than: and the rest), “has attachment”, more than 20 conditions or 10 actions, “skip the inbox” with no label, removing a label — which includes “never send it to spam” — and several addresses in one field alongside another test. Each refusal is named on import.
Groups become aliases to their members. A group’s archive, moderation and posting rules do not come across, and nested groups are skipped.
Discovery stops at 5,000 users and 1,000 groups without saying so, and reads vacation, filters and forwarding for the first 200 mailboxes only, with a warning for the rest.
Google has no read-only scope for mail settings, so importing filters and responders needs a grant that could write. The connector only reads, and a test asserts it; turn the option off and only the rule import is lost.

1
Set up delegation
This is the step that takes the longest and has nothing to do with mail: a service account, the right scopes, and an administrator to authorise it.
2
Add the domain here first
Records published and verified, MX untouched.
3
Read the source, then import
Every user with their aliases, plus groups, vacation responders, filters and auto-forwarding. Missing mailboxes are created with new passwords, shown once; the rest is imported, and a filter that cannot be carried across exactly is refused with a note.
4
Run the full copy
The connector mints a token per user, because Google’s delegation is per-user, and refreshes it during the run — an hour-long token under a copy that takes longer is the classic failure and is handled.
5
Change the MX, then sync the delta
Google keeps delivering until the MX moves. The delta brings across everything that arrived meanwhile.
6
Walk the checklist
Clients, new passwords, the filters that were refused, group archives, and the calendar decision.

A Google Cloud service account with a JSON key and domain-wide delegation, authorised for the directory, Gmail and IMAP scopes.
A Workspace administrator to authorise that delegation, and a super-admin address in the domain, which the user and group lists are read as.
IMAP enabled for the users being moved. It is on by default; an organisation that turned it off fails every mailbox at login.