Migrate Bluehost Email to Office 365: Full IMAP Cutover

Bluehost bundled email is the kind of service that works just fine until you actually try to do business email with it. Storage caps are tight, spam filtering is basic, and there is no real admin console for managing more than a handful of users. Moving to Office 365 fixes all of those, but the Bluehost side is built around cPanel, and most generic migration guides assume you have a real mail platform on the source. This guide is written for the cPanel reality, including where MX records live and how Bluehost's IMAP throttling actually behaves.

What Bluehost email actually is#

Bluehost is a hosting provider, and the email product is the standard cPanel email accounts feature with Bluehost's own web wrapper around it. Each mailbox is a Maildir on a shared server, accessible by:

• IMAP on mail.yourdomain.com (or the shared host they assign you) port 993 with SSL
• POP3 on the same host port 995 with SSL (do not use this)
• SMTP on the same host port 465 with SSL or 587 with STARTTLS
• Webmail through Bluehost's hosted Roundcube or Horde interface

There is no migration API on the Bluehost side. There is no "export everything as PST" button. Everything moves over IMAP, and your job as the admin is to make that IMAP pipe work reliably for as long as the bulk copy takes.

Inventory before you do anything#

In the Bluehost account manager, navigate to your cPanel and pull a full list from Email Accounts. Capture:

• Every mailbox address
• Current password (or note that you'll have to reset it for the migration window)
• Mailbox storage quota and used space
• Every forwarder under Email, Forwarders
• Every alias under Email, Aliases (less common but check)
• Autoresponder text for any account that has one set
• Filter rules per account (these live in Email, Email Filters)

Save it as a spreadsheet. You will use this list to provision Office 365 users, recreate aliases on the destination, and verify post-cutover counts.

Prepare the destination tenant#

In the Microsoft 365 admin centre:

1. Verify your domain. Microsoft gives you a TXT record. Add it inside the Bluehost DNS Zone Editor in cPanel under Domains, DNS.
2. Create matching user mailboxes. Match the SMTP address character-for-character to the Bluehost source. Mismatched casing is fine, but a typo here means you'll find it during validation rather than now.
3. Assign Exchange Online licences. Wait 15 to 60 minutes for new mailboxes to provision fully.
4. Pre-create distribution groups for any Bluehost mailing lists.
5. Pre-create aliases on each user to mirror the Bluehost aliases and forwarders.

For the IMAP write into Office 365, plan on OAuth2 with admin consent for the migration scope. Basic auth into Office 365 IMAP has been disabled by default since 2022. If your migration tool only supports basic auth, you will need to grant it the IMAP scope explicitly in Azure AD.

The migration plan#

1. Lower MX TTL in cPanel

   Open cPanel, go to Domains, DNS Zone Editor. Find the MX record and reduce its TTL to 300 seconds. Save. Wait at least 24 hours before the cutover so that resolvers worldwide honour the shorter TTL.

2. Reset mailbox passwords if you don't have them

   For each Bluehost mailbox you need to migrate, set or reset the password from cPanel, Email Accounts, Manage. Use the reset password during the migration window only; users can keep their original after cutover (or you can leave the reset in place, since the source is being decommissioned).

3. Pre-stage the bulk copy

   Start the IMAP-to-IMAP migration from Bluehost to Office 365. Users keep working on Bluehost. The copy can run for hours or days depending on size. Plan five concurrent connections per mailbox max; Bluehost will throttle harder than that.

4. Communicate the cutover

   Send a two-paragraph note to users two days out: the change is happening, their address is staying the same, historical mail will already be in the new mailbox, and here is the new client setup.

5. Flip MX in cPanel

   In cPanel, Domains, DNS Zone Editor, edit the MX record. Replace the existing host (usually mail.yourdomain.com pointing at the Bluehost shared server) with the Microsoft host shown in the Microsoft 365 admin centre. Format is yourdomain-com.mail.protection.outlook.com at priority 0. Save.

   Also confirm the "Email Routing" setting in cPanel Email Routing is set to "Remote Mail Exchanger" not "Local Mail Exchanger". If it stays on local, Bluehost will keep delivering mail to its own local mailbox for your domain even though external MX says Office 365.

6. Run the delta sync

   Within an hour of MX cutover, run a final delta pass. Catches mail that arrived at Bluehost between the bulk pre-stage and the MX flip. Usually a few hundred messages per active mailbox.

7. Update SPF and DKIM

   Update SPF in the cPanel DNS Zone Editor: replace any existing Bluehost include with include:spf.protection.outlook.com.

   Enable DKIM in the Microsoft 365 Defender portal and add the two CNAME records Microsoft generates to Bluehost DNS. Without DKIM your outbound mail will hit spam filters within a week.

8. Validate and reconfigure clients

   Walk users through removing the Bluehost account in their mail client and adding the Office 365 account. Outlook auto-discovers from the email address; Apple Mail prompts for OAuth. Verify a sample of mailboxes against the source for folder counts.

Email Routing: the Bluehost gotcha#

The single most common reason an MX flip at Bluehost doesn't work is the cPanel "Email Routing" setting. Even after you change the public MX record to point at Office 365, Bluehost's mail server checks this internal setting first. If it is set to "Local Mail Exchanger" or "Automatically Detect Configuration", Bluehost may keep delivering mail to its own local mailboxes instead of relaying to Microsoft.

After flipping MX:

1. Open cPanel, Email, Email Routing.
2. Find your domain.
3. Set it to "Remote Mail Exchanger".
4. Save.

Test by sending a message from an external account. The headers should show Microsoft's protection.outlook.com host, not a Bluehost host.

Errors you will see during the IMAP copy#

Bluehost throttles IMAP fairly aggressively per IP. Errors and fixes:

• Too many simultaneous connections — drop to five concurrent workers per mailbox. Bluehost's shared IMAP servers do not document a limit but in practice it sits around 10.
• AUTHENTICATIONFAILED — usually a wrong password (Bluehost passwords are case-sensitive) or username (must be the full email address, not just the local part).
• STARTTLS handshake failed — you're using port 143 with STARTTLS. Switch to 993 implicit SSL.
• Folder UTF-7 conversion error — uncommon but possible if the source mailbox has folders with accented characters. Most cPanel webmail clients use plain ASCII folder names.
• Message too large for destination — Office 365 caps at 150 MB. Bluehost's incoming message size cap is typically 50 MB so you're rarely hitting this from the source.
• Connection unexpectedly closed — Bluehost will kill long-running IMAP sessions after about 30 minutes. Use a tool that reconnects and resumes automatically.

Where Mailbox Taxi fits#

Mailbox Taxi runs as a desktop tool on Windows, Mac, or Linux. It treats Bluehost cPanel IMAP and Office 365 as two endpoints, handles reconnection on Bluehost's session timeouts, and keeps a per-message manifest so the delta pass after MX cutover only copies what is genuinely new. For a generic cPanel source (not Bluehost-specific), the cPanel to Office 365 guide covers the same mechanics in less Bluehost-specific terms. If you are weighing destinations, migrating Bluehost to Gmail walks the Google Workspace alternative. And the broader Office 365 migration playbook covers tenant licensing, retention policies, and the post-migration security baseline.

Validation steps#

In the first hour after MX cutover:

• Inbound test: external Gmail sender to a migrated mailbox. Message should land in the Office 365 inbox within 30 seconds.
• Outbound test: from the Office 365 mailbox to an external address. Headers should show SPF pass and DKIM signature from Microsoft.
• DNS check: dig MX yourdomain and dig TXT yourdomain should show the new Microsoft MX and the updated SPF.
• Folder verification: pick three migrated mailboxes (one heavy, one light, one shared). Compare IMAP folder counts on the source against Office 365. Differences over 1% need a second delta pass.
• Outlook autodiscover: open Outlook on a test user's machine. It should pick up the Office 365 server without manual server entry. If not, your autodiscover CNAME is missing.

For mechanics of what an MX flip is doing, the MX record glossary is the short explainer.

Decommissioning Bluehost mail#

Keep Bluehost mailboxes paid and reachable for 30 days post-cutover. During that window:

• Verify external senders are reliably reaching the Office 365 mailboxes
• Catch any unmigrated alias or forwarder
• Confirm that all client devices are reconfigured

After 30 days, cancel the Bluehost email product (your hosting subscription can stay if Bluehost still hosts your website; only the email feature needs decommissioning). Delete the Maildir on the cPanel side as a final cleanup step.