WorkMail

WorkMail is organized around the concept of an Organization, which maps to an email domain. Each organization has an associated AWS directory (Managed AD, Simple AD, or an existing directory) and mailboxes for users and groups.

Inbound mail flows: external sender -> WorkMail MX endpoint -> (optional Lambda inbound hook) -> recipient mailbox. Outbound mail flows: user sends -> (optional Lambda outbound hook) -> WorkMail SMTP -> (optional SES for sending) -> internet.

Setting up a domain in WorkMail requires adding several DNS records to route mail correctly and improve deliverability. Missing or incorrect records are the most common reason for deliverability issues.

# Verify a domain for WorkMail via CLI
aws workmail create-organization \
  --alias mycompany \
  --directory-id d-9067abc123

# Register a domain with an organization
aws workmail register-mail-domain \
  --organization-id m-abc12345678 \
  --domain-name mycompany.com

# Get the DNS records needed for the domain
aws workmail get-mail-domain \
  --organization-id m-abc12345678 \
  --domain-name mycompany.com

WorkMail supports multiple connection protocols that map to different client types.

Outlook auto-discovery uses the AutoDiscover CNAME record to automatically configure server settings. When a user adds their WorkMail email address to Outlook, Outlook queries the AutoDiscover endpoint and receives the MAPI/HTTP connection settings without manual configuration.

Email flow rules let you intercept and process email at the organization level using Lambda functions. This enables custom spam filtering, compliance archiving, content inspection, and routing logic without modifying the mail server.

# Lambda function handler for WorkMail inbound processing
import boto3
import json

def handler(event, context):
    # event contains: messageId, invocationId, flowDirection, truncated
    message_id = event['messageId']
    
    # Retrieve the raw email message
    workmail = boto3.client('workmailmessageflow')
    response = workmail.get_raw_message_content(
        messageId=message_id
    )
    raw_message = response['messageContent'].read()
    
    # Inspect content - example: block messages with specific subject
    if b'URGENT WIRE TRANSFER' in raw_message:
        return {'actions': [{'action': {'type': 'DROP'}}]}
    
    return {'actions': [{'action': {'type': 'DEFAULT'}}]}

WorkMail encrypts all mailbox data at rest using KMS and in transit using TLS. Additional security features control mobile device access and email client behavior.

# Create an access control rule to block IMAP for all users
aws workmail put-access-control-rule \
  --organization-id m-abc12345678 \
  --name BlockIMAPAll \
  --effect DENY \
  --description "Block IMAP access org-wide" \
  --ip-ranges "0.0.0.0/0" \
  --actions IMAP

# Allow ActiveSync only from corporate IP range
aws workmail put-access-control-rule \
  --organization-id m-abc12345678 \
  --name AllowActiveSyncCorporate \
  --effect ALLOW \
  --description "ActiveSync from corporate network only" \
  --ip-ranges "203.0.113.0/24" \
  --actions ActiveSync

WorkMail pricing is per-user per-month with a flat rate that includes storage. There are no data transfer charges for email sent within AWS services.

Migrating to WorkMail from Exchange or Office 365 typically involves exporting mailboxes as PST files and importing them via the WorkMail Migration Tool, or using a third-party migration tool that supports IMAP migration. For large migrations, AWS recommends using the WorkMail Migration API which supports delta syncs.