Migrate IONOS Email to Office 365: A Complete Guide

IONOS mail is solid for the price, but the moment your team grows past a handful of mailboxes the gaps start to bite: weak shared-mailbox tooling, basic spam filtering, and no native calendar federation. Moving to Office 365 fixes all three at once, but the path is rougher than it looks. There is no admin console connector between IONOS and Microsoft 365, no bulk export tool that preserves folder hierarchy, and MX cutover happens inside the IONOS Domains panel where one wrong save can blackhole inbound mail for hours. This guide walks the full migration end to end.

Why IONOS migrations are slightly different#

IONOS is an IMAP-first mail platform with regional hosts. Unlike Gmail or Microsoft, there is no migration API you can call from the destination side. Office 365's built-in IMAP migration endpoint will technically pull from IONOS, but it is single-threaded, capped at 50 concurrent connections per source, and silently skips folders whose names use UTF-7 modified encoding (which IONOS uses for any non-ASCII folder name). Most IONOS tenants in Germany, Spain, and France hit this on day one and never finish.

A desktop IMAP migration tool sidesteps that by running multiple worker threads per mailbox locally and handling the folder-name conversion correctly. That is the model we recommend below.

Inventory before you touch anything#

Pull a clean inventory from the IONOS Mail Basic or Mail Business panel:

• Every mailbox, including the catch-all
• Every alias and forwarder
• Distribution lists (IONOS calls these "mailing lists")
• Shared folders or public folders, if any
• Mailbox sizes (note anything over 25 GB)
• Domain count and current MX records

Export it to a spreadsheet. You will reuse this list to provision Office 365 users, to map aliases, and to confirm post-cutover counts. Skipping this step is the single most common cause of "we lost an inbox" tickets two weeks after cutover.

Confirm the IONOS IMAP host#

IONOS uses regional hosts depending on which IONOS entity owns the account:

• Global / United States: imap.ionos.com
• Germany: imap.ionos.de
• United Kingdom: imap.ionos.co.uk
• Spain: imap.ionos.es
• France: imap.ionos.fr

All use port 993 with implicit SSL. The username is the full email address. Test one mailbox from a regular IMAP client before you touch anything else; if it logs in cleanly there, your migration tool will work too.

If two-factor authentication is on, generate an application password from the user's IONOS account settings (under Security or Two-Factor Authentication). Store these somewhere your migration tool can access them at run time. The regular login password will return AUTHENTICATIONFAILED against IMAP when 2FA is active.

Prepare the Office 365 tenant#

In the Microsoft 365 admin centre:

1. Verify your domain (you will add a Microsoft-supplied TXT record in IONOS DNS).
2. Create each destination user. Match the primary SMTP address exactly to the IONOS source.
3. Assign licences with Exchange Online enabled.
4. Wait for each mailbox to provision. New mailboxes can take 15 to 60 minutes before they accept IMAP or migration traffic. Trying to write to a mailbox that has not finished provisioning will return Mailbox not available.
5. Pre-create any shared mailboxes, resources, and distribution groups from the inventory spreadsheet.

For the IMAP sync itself you have two access patterns into Office 365: modern OAuth (recommended) or basic auth with an app password against outlook.office365.com:993. Basic auth has been disabled by default since 2022, so plan for OAuth unless your migration tool prefers IMAP-to-IMAP, in which case you will need to grant the migration app the IMAP scope through admin consent.

The migration itself, step by step#

1. Lower the MX TTL early

   A week before the planned cutover, edit the MX TTL in IONOS DNS down to 300 seconds. This shortens the window during which old mail servers cache the IONOS MX after you switch it.

2. Pre-stage the bulk copy

   Start the IMAP-to-IMAP copy from IONOS to Office 365 while your users are still working on IONOS. This is the bulk of the data movement and it can run for hours or days without affecting anyone. Use a tool that resumes on failure and keeps a per-message manifest, so the delta pass later only copies what is new.

3. Communicate the cutover

   Send users a one-paragraph email two days before the change. Tell them when their client will need to be reconfigured, that they will keep their address, and that historical mail will already be in the new mailbox when they open it.

4. Flip the MX record in IONOS

   Inside the IONOS Domains & SSL panel, open the domain, edit the DNS settings, and replace the existing MX (typically mx00.ionos.com, mx01.ionos.com) with the single Microsoft host shown in the Microsoft 365 admin centre. It looks like yourdomain-com.mail.protection.outlook.com with a priority of 0.

5. Run the delta sync

   Immediately after the MX flip, run a final delta pass from IONOS to Office 365. Any mail that arrived at IONOS in the last few hours, or during the DNS propagation window, will be moved across. Most migrations see between 50 and 2,000 messages in this final pass.

6. Reconfigure clients and validate

   Walk users through removing the IONOS account in Outlook, Apple Mail, or their mobile client and adding the Office 365 account with autodiscover. Confirm folder counts match the IONOS source for at least three random users before you call the migration done.

DNS records you cannot forget#

The MX flip alone is not enough. You also need to update:

• SPF: replace the IONOS include (include:_spf.kundenserver.de) with include:spf.protection.outlook.com. Keep the SPF record short; do not stack both.
• Autodiscover: add the CNAME autodiscover.yourdomain pointing to autodiscover.outlook.com. Without this, Outlook clients will keep trying to autoconfigure against IONOS for weeks.
• DKIM: enable DKIM signing in the Microsoft 365 Defender portal, then add the two CNAMEs Microsoft generates to IONOS DNS. Do this within 24 hours of cutover or your outbound mail will start landing in spam folders.
• DMARC: if you already had a DMARC record at IONOS, leave it. If not, start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain and tighten over the next month.

Throttling, retries, and the errors you will see#

IONOS rate-limits IMAP connections fairly aggressively. Expect to see these in the logs and know what to do:

• Too many simultaneous connections — back off the worker count. Five concurrent connections per mailbox is the sweet spot; ten will get you throttled by message 4,000.
• AUTHENTICATIONFAILED — either the wrong host (regional mismatch), or 2FA is on and you tried to use the regular password instead of an app password.
• STARTTLS handshake failed — you are pointing at port 143. IONOS prefers implicit SSL on 993; switch the port and the error goes away.
• Folder UTF-7 conversion error — common on German and French tenants with folders like "Gelöscht" or "Éléments envoyés". Your migration tool needs IMAP modified UTF-7 support; the built-in Office 365 importer does not handle this consistently.
• Message too large for destination — Office 365 rejects messages over 150 MB. IONOS allows attachments up to 70 MB but very old mail may include forwarded chains that exceed the limit when re-encoded. Quarantine these and move them via PST as a one-off.

Where Mailbox Taxi fits#

Mailbox Taxi runs on your own laptop and treats both IONOS and Office 365 as standard IMAP endpoints. It handles the UTF-7 folder name conversion, throttles itself when IONOS pushes back, and keeps a per-message manifest so the delta pass after MX cutover only touches mail that did not move in the pre-stage. For the broader plan around DNS, licensing, and user comms, the Office 365 migration playbook covers the destination side. If you want a generic IMAP-source perspective rather than IONOS-specific, the IMAP to Office 365 walkthrough covers the source-agnostic mechanics. And if you are weighing destinations, the IONOS to Gmail variant walks the same source towards Google Workspace.

Validating the cutover#

After MX flips, do these checks within the first 60 minutes:

• Send a test message from an outside Gmail account to one of the migrated mailboxes. It should land in the Office 365 inbox.
• Send a test from the Office 365 mailbox to that outside account. Check headers; the message should be signed by Microsoft and pass SPF.
• Use mxtoolbox.com to confirm the MX, SPF, and DKIM records are live and matching Microsoft's recommended values.
• Spot-check three migrated mailboxes against the source. Pick one heavy user, one light user, and the catch-all. Folder counts should match within a handful of messages (delta pass may add a few).

If counts are off by more than 1%, run a second delta pass before you decommission the IONOS account. Do not delete the IONOS mailbox for at least 30 days; you may need it.

Decommissioning IONOS#

Once you have signed off on validation:

• Disable the IONOS mailboxes but keep them paid for 30 days as a fallback.
• Cancel the IONOS Mail Basic or Mail Business subscription after the 30-day window.
• Keep the domain at IONOS if that is where it lives; only the mail product is moving. Domain transfer is a separate decision.
• Archive the migration manifest somewhere your team can find it during the inevitable "where did that email go" ticket six weeks later.

For the wider context on phased versus weekend cutovers and how to size the bulk pre-stage window, the full migration guide lays out the trade-offs. If you want a record-by-record explanation of what an MX flip is actually doing under the hood, the MX record glossary is the shortest write-up of that mechanic.