Migrate cPanel Email to Gmail: Generic Workspace Plan

cPanel powers a huge slice of low-cost hosted mail, and the move to Google Workspace is one of the most common migrations an MSP sees. The mail itself copies cleanly over IMAP. The trap is the cPanel-side configuration: MX records live in DNS Zone Editor, but the internal "Email Routing" flag also has to be flipped to "Remote Mail Exchanger" or cPanel keeps delivering inbound mail to itself. Google's own Data Migration Service handles cPanel sources poorly, especially around throttling and resume. This guide is the version that finishes inside a weekend regardless of which hosting brand sells you the cPanel.

What cPanel email actually is#

cPanel is a Linux server management UI from cPanel L.L.C., bundled by Bluehost, HostGator, A2 Hosting, SiteGround, Namecheap shared hosting, and thousands of smaller regional providers. The mail stack underneath is always the same:

• Postfix or Exim for SMTP
• Dovecot for IMAP/POP3
• Roundcube and/or Horde as webmail
• cPanel UI for management

From the outside, every cPanel mail account looks identical:

• IMAP on mail.yourdomain.com port 993 SSL
• SMTP on the same host port 465 SSL or 587 STARTTLS
• Webmail via the cPanel webmail subdomain (usually webmail.yourdomain.com)

What changes between hosts is the cPanel version, the UI layout, the per-IP IMAP throttling threshold, and the level of customer support you'll get when something goes wrong. The mechanics of migration are identical.

Inventory before anything#

In cPanel, walk through and capture:

• Email, Email Accounts — every mailbox with current size and quota
• Email, Forwarders — every mail forwarder (one-to-one and one-to-many)
• Email, Email Filters — per-account filter rules
• Email, Autoresponders — vacation messages set on individual mailboxes
• Email, Mailing Lists — distribution lists, where present
• Email, Default Address — the catch-all

Spreadsheet it. You will use this to provision Workspace users, recreate forwarders as aliases or groups, and verify post-cutover counts. The most common cause of "where did this email go" tickets weeks after cutover is a forwarder that was never recreated on the Google side.

Provision Google Workspace#

In the Workspace admin console:

1. Verify your domain. Google provides a TXT record. Add it inside cPanel, Domains, DNS Zone Editor. Verification usually completes within 30 minutes.
2. Buy seats. Buy one more than the user count to cover the catch-all and any service account.
3. Create each user. Match the primary email address exactly to the cPanel source.
4. Create Google Groups for any cPanel mailing lists. Add the same members.
5. Add Workspace aliases mirroring cPanel one-to-one aliases and forwarders.

For IMAP authentication into Gmail during migration, two options:

• Per-user app passwords: turn on IMAP in each Gmail user's settings, generate app passwords. Tedious past 10 users.
• OAuth with service account and domain-wide delegation: configure once in Google Cloud Console, authorise the migration scope, the tool impersonates each user during copy. Use this for anything non-trivial.

The migration plan#

1. Lower MX TTL in cPanel

   cPanel, Domains, DNS Zone Editor. Edit the MX. Drop TTL to 300 seconds. Save. Wait 24 hours so global resolvers update.

2. Reset mailbox passwords if needed

   From cPanel, Email Accounts, set or reset each mailbox password. You need these for the migration tool to authenticate against cPanel IMAP. Store securely; rotate after cutover.

3. Pre-stage the bulk copy

   Start the cPanel-to-Gmail IMAP migration. Users keep working on cPanel. Expect 1 to 2 GB per hour at five concurrent workers per mailbox. cPanel shared IMAP servers throttle around 10 concurrent connections per source IP.

4. User communication

   Two days out, send a one-paragraph note: change is happening, addresses stay the same, historical mail will already be in the new mailbox, here are the client setup steps for cutover day.

5. Flip public MX in cPanel DNS

   cPanel, Domains, DNS Zone Editor. Replace existing MX with Google's five hosts:

   • ASPMX.L.GOOGLE.COM priority 1
   • ALT1.ASPMX.L.GOOGLE.COM priority 5
   • ALT2.ASPMX.L.GOOGLE.COM priority 5
   • ALT3.ASPMX.L.GOOGLE.COM priority 10
   • ALT4.ASPMX.L.GOOGLE.COM priority 10

   Save.

6. Change Email Routing to Remote

   cPanel, Email, Email Routing. Select your domain. Change from "Local Mail Exchanger" or "Automatically Detect Configuration" to "Remote Mail Exchanger". Save.

   This is the cPanel-specific gotcha. Without this change, cPanel keeps delivering inbound mail to its own Maildir even though public MX points at Google. Symptom: external senders see "delivered" but no mail appears in Gmail.

7. Run delta sync

   Immediately after MX flip and Email Routing change, run a delta pass from cPanel to Gmail. Catches messages that arrived during the cutover window.

8. Update SPF, DKIM, DMARC

   SPF in cPanel DNS:

   v=spf1 include:_spf.google.com ~all

   DKIM in Workspace admin: Apps, Google Workspace, Gmail, Authenticate email. Generate the key, add it as TXT at google._domainkey.yourdomain in cPanel DNS.

   DMARC: start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain if you don't have one already.

9. Reconfigure clients

   Walk users through removing the cPanel account from their mail client and adding the Workspace account. Workspace auto-configures from email and password on Outlook 2019+, Apple Mail, and most mobile clients.

Why Email Routing is the most common cutover failure#

cPanel's Exim mail server uses two signals to decide what to do with inbound mail:

1. The MX record (queried from public DNS)
2. The internal Email Routing setting in cPanel

If MX points externally but Email Routing is still "Local Mail Exchanger" or "Automatic", Exim sees that local Maildirs exist for the domain and delivers to them anyway. The sender's mail server gets a successful response. The mail piles up on the cPanel server. Nothing appears in Gmail. The admin assumes the migration is broken when actually the cPanel-side flag was never set.

The fix:

1. cPanel, Email, Email Routing.
2. Select the domain.
3. "Remote Mail Exchanger".
4. Save.

Verify with a test message from an external Gmail account. Headers on the received message should reference aspmx.l.google.com or a Google IP, not any cPanel hostname.

Gmail behaviour after migration#

A few Gmail quirks coming from cPanel webmail (Roundcube or Horde):

• Folders become labels. A cPanel folder Clients/Acme is now a Gmail label of the same nested name. Messages can hold multiple labels simultaneously.
• Conversation threading. Gmail groups messages by subject and headers into threads. Users coming from Roundcube find this jarring at first. They can turn it off in Gmail settings.
• All Mail. Gmail keeps every message in a special "All Mail" label regardless of folder. Use this for total-count verification.
• Sent and Drafts. Map automatically to Gmail's system labels of the same name.
• Spam. Gmail's spam filter is much more aggressive than cPanel's default. Expect users to find legitimate mail in spam during the first week and need to mark "Not Spam".

Errors during the IMAP copy#

• Too many simultaneous connections from cPanel. Drop to five workers per mailbox. Most cPanel hosts throttle around 10 connections per source IP.
• AUTHENTICATIONFAILED against cPanel. Username must be full email; password must match cPanel exactly.
• Connection unexpectedly closed. cPanel hosts kill long IMAP sessions after about 30 minutes. Use a migration tool that auto-reconnects and resumes.
• OAuth2 token expired against Gmail. Migration scope refresh tokens expire after seven days idle. Refresh before resuming if paused.
• Lookup failed against Gmail. Destination mailbox hasn't finished provisioning. Wait 5 to 30 minutes for new Workspace mailboxes.
• Message too large for destination. Gmail allows up to 50 MB inbound over IMAP. Larger messages need a one-off MBOX export and manual import.
• Folder UTF-7 conversion error. Uncommon on cPanel but possible if Roundcube users created folders with accented characters.

Where Mailbox Taxi fits#

Mailbox Taxi runs on your laptop and treats cPanel IMAP and Gmail as two standard endpoints. It auto-reconnects on cPanel session timeouts, deduplicates cross-folder messages correctly on the Gmail side, and keeps a per-message manifest for resumable delta passes. If you would rather see the Microsoft destination, the cPanel to Office 365 walkthrough covers the same source. If your specific cPanel host is Bluehost, see the Bluehost to Gmail guide. For HostGator, see the HostGator to Gmail guide. For a fully generic IMAP source, the IMAP to Gmail walkthrough covers the source-agnostic mechanics. And the broader Google Workspace migration playbook covers Workspace tenant setup, SSO, and security baselines.

Validation in the first hour#

After MX cutover and Email Routing change:

• Inbound test: external Gmail to a migrated mailbox. Should land in Workspace inbox within 30 seconds.
• Outbound test: from Workspace to external. Headers should show SPF pass and DKIM signature from Google.
• DNS: dig MX yourdomain should return Google's five MX hosts.
• Folder verification: sample three mailboxes (heavy, light, shared). Compare cPanel folder counts to Gmail labels plus All Mail count. Within 1% is acceptable.
• Workspace client test: add the account to a fresh Outlook profile. Should auto-configure without manual server entry.

Decommissioning cPanel email#

Keep cPanel mailboxes paid and reachable for 30 days post-cutover. During the window:

• Verify reliable inbound mail flow to Workspace
• Catch any forwarder, alias, or mailing list missed
• Confirm every client device is reconfigured

After 30 days, the cPanel email piece can be effectively decommissioned. If the cPanel subscription includes hosting for a website that stays, only the email feature is being abandoned. Delete the Maildir on the cPanel side as a final cleanup. The domain itself can stay at the same registrar or move separately; that's a different decision.