Bluehost is fine as a web host. As an email host, it was costing my client real money — not in fees, but in leverage. Every time they wanted to leave, "but our email lives there" ended the conversation.
So I moved them to Namecheap Private Email. Total cost: $14.88/year. Total downtime: zero. Here's exactly how.
Why not Google Workspace?
For a 3-person business, Workspace is $7/user/month — $252/year before you blink. Namecheap Private Email Starter is $14.88/year for a 5GB mailbox, with a 60-day free trial. The client sends maybe 40 emails a day. The math wasn't close.
The tradeoff is real, though: no shared calendars, no Drive, a webmail UI from 2012. For this client, that was fine. Know what you're giving up before you switch.
The migration order matters
Do it in this order and nobody loses an email:
- Create the mailbox first. Sign up for Namecheap Private Email, create the actual addresses (info@, michael@) before touching DNS. Empty mailboxes waiting for mail are fine; mail with nowhere to land is not.
- Lower the TTL. On the existing MX records, drop TTL to 300 seconds at least a few hours before the cutover. This is the step everyone skips and then complains about "DNS propagation."
- Add the new MX records alongside the old ones — no. Delete the old, add the new, in one edit. Two MX sets means mail roulette.
- Add SPF, DKIM, DMARC. In that order. Test each before moving on.
- Migrate old mail (optional). I used IMAP sync to pull the old Bluehost mailbox contents into the new one. For this client, only 6 months of mail mattered.
The exact DNS records
These go in wherever your DNS lives — mine's in DigitalOcean, but the records are the same everywhere. Replace example.com with the real domain.
MX (delete the Bluehost ones first):
| Host | Value | Priority |
|---|---|---|
| @ | mx1.privateemail.com | 10 |
| @ | mx2.privateemail.com | 20 |
SPF (TXT record on @):
v=spf1 include:spf.privateemail.com ~all
Note the ~all (softfail), not -all. Start soft. Move to hardfail after a week of clean logs if you're feeling strict.
DKIM: Namecheap gives you the selector and key in the Private Email dashboard under "Email Authentication." It's a TXT record on something like default._domainkey — copy it verbatim, don't retype it. One transposed character and signing silently fails.
DMARC (TXT record on _dmarc):
v=DMARC1; p=none; rua=mailto:dmarc@example.com
Start at p=none with a reporting address. Watch the reports for a week. Then — and only then — consider p=quarantine. Jumping straight to p=reject on day one is how legitimate mail starts bouncing.
Verify before you declare victory
- Send to mail-tester.com — you want 10/10.
- Check DKIM signing with Gmail: send to a Gmail address, "Show original," confirm
dkim=pass. - Wait 48 hours, then check the DMARC reports actually arriving.
What I'd do differently
Honestly? I'd have lowered the TTL a full day earlier instead of a few hours. One mailbox took 6 hours to start receiving because a resolver somewhere cached the old MX. Nobody noticed — but I noticed, and it bugged me.
Total time: about 2 hours, most of it waiting on DNS. Total cost: $14.88/year vs. being locked to a host. If your client's email is the thing keeping them on a host they hate, this is the unlock.