Email Client Settings Cheat Sheet: IMAP, POP3 and SMTP Servers, Ports and Sign-In for Every Common Provider

Setting up a mailbox on a phone or in Outlook, or fixing one that keeps asking for a password, comes down to the same handful of values: server name, port, encryption and sign-in method. This sheet puts them on one page for the providers small businesses use most, plus generic hosting mail. For step-by-step troubleshooting, see mail apps that keep asking for a password or cannot send.

Read this first: values were checked against each provider’s help pages in November 2026. Providers change sign-in rules more often than server names, so the “Sign-in” column matters most. If your provider’s current help page or admin console disagrees with this sheet, believe the provider. Replace example.com with your domain and mail.example.com with the server name your host shows.

Ports at a glance

Port	Protocol	Encryption	Use it for	Notes
993	IMAP	SSL/TLS (implicit)	Receiving, folders synced with the server	The default choice for receiving
143	IMAP	STARTTLS, or none	Legacy receiving	Only if 993 is unavailable, and never without STARTTLS
995	POP3	SSL/TLS (implicit)	Receiving to one device	POP downloads mail; it may then be deleted from the server
110	POP3	STARTTLS, or none	Legacy receiving	Avoid
465	SMTP submission	SSL/TLS (implicit)	Sending from a mail app or website	RFC 8314 prefers implicit TLS for submission
587	SMTP submission	STARTTLS	Sending from a mail app or website	The submission port defined in RFC 6409; still widely used
25	SMTP relay	STARTTLS where offered	Server to server delivery only	Many internet and cloud providers block outgoing 25; do not use it in mail apps
2525	SMTP (non-standard)	Varies	Some transactional email services offer it as an alternative	Not a standard port; only if the service documents it

The rule that fixes most sending problems: 465 goes with SSL/TLS, 587 goes with STARTTLS. Mixing them fails every time.

What the encryption labels mean in each app

What it is	Outlook	Apple Mail (Mac), iPhone	Thunderbird
Encrypted from the first byte (ports 993, 995, 465)	SSL/TLS	Use TLS/SSL on; iPhone: Use SSL on	SSL/TLS
Starts plain, then upgrades (port 587, sometimes 143)	STARTTLS	Use TLS/SSL on (the app negotiates STARTTLS on 587)	STARTTLS
Let the app guess	Auto	Automatically manage connection settings	Autodetect
No encryption	None	Use TLS/SSL off	None

“SSL” in app settings almost always means TLS today; the old SSL protocol itself is long retired.

Provider settings

Provider	IMAP	POP3	SMTP	User name
Gmail and Google Workspace	imap.gmail.com 993 SSL/TLS	pop.gmail.com 995 SSL/TLS	smtp.gmail.com 587 STARTTLS	Full address
Microsoft 365 (Exchange Online)	outlook.office365.com 993 SSL/TLS	outlook.office365.com 995 SSL/TLS	smtp.office365.com 587 STARTTLS	Full address (user principal name)
Outlook.com, Hotmail, Live (personal)	outlook.office365.com 993 SSL/TLS	outlook.office365.com 995 SSL/TLS	smtp-mail.outlook.com 587 STARTTLS	Full address
iCloud Mail	imap.mail.me.com 993 SSL/TLS	Not supported	smtp.mail.me.com 587, SSL/TLS or STARTTLS, authentication required	IMAP: usually the part before the @, full address if that fails. SMTP: full address
Zoho Mail (organization)	imappro.zoho.com 993 SSL/TLS	poppro.zoho.com 995 SSL/TLS	smtppro.zoho.com 465 SSL/TLS or 587 STARTTLS	Full address
Zoho Mail (personal)	imap.zoho.com 993 SSL/TLS	pop.zoho.com 995 SSL/TLS	smtp.zoho.com 465 SSL/TLS or 587 STARTTLS	Full address
Fastmail	imap.fastmail.com 993 SSL/TLS	pop.fastmail.com 995 SSL/TLS	smtp.fastmail.com 465 SSL/TLS (587 STARTTLS for apps that need it)	Full address
Proton Mail (via Bridge)	127.0.0.1 1143	Not supported	127.0.0.1 1025	Shown in Bridge; encryption is STARTTLS by default, switchable to SSL in Bridge
cPanel hosting mail	Server name from Connect Devices, 993 SSL/TLS	Same server, 995 SSL/TLS	Same server, 465 SSL/TLS	Full address
Plesk hosting mail	Server name from the Mail tab, 993 SSL/TLS	995 SSL/TLS	465 SSL/TLS or 587 STARTTLS	Full address
Enhance hosting mail	Server name from the website’s Emails tab, 993 SSL/TLS	995 SSL/TLS	465 SSL/TLS or 587 STARTTLS, as shown in the panel	Full address

• Gmail: Google’s POP settings page lists pop.gmail.com on 995 and smtp.gmail.com with port 587 for TLS/STARTTLS; older Google pages also listed port 465 with SSL. Google’s current IMAP help no longer shows server names and tells you to use the app’s “Sign in with Google” option instead, which fills them in for you. Workspace users should check with their admin, who can restrict IMAP, POP and app passwords. Google allows up to 15 email clients connected at once per account.
• Zoho: accounts in other data centers use a different domain ending (for example zoho.eu or zoho.in). Use the domain your Zoho login page uses, and enable IMAP or POP access in Zoho Mail settings first (the menu can differ between plans, so search Zoho’s help for IMAP access or POP access).
• Fastmail: Fastmail also documents proxy host names for networks that block standard mail ports; see its server names page.
• Proton: Bridge must be running on the same computer. If its ports are in use, Bridge lets you change them under Settings, Advanced settings, Default ports. Proton’s support pages say Bridge is available only with a paid plan.
• Hosting panels: the server name is often the server’s own host name, not mail.example.com, because that is the name on the server’s certificate. If you use mail.example.com and get certificate warnings, switch to the name the panel shows. Plesk servers can use a self-signed mail certificate unless the host has installed a trusted one.

Sign-in method by provider

Provider	Plain password in a mail app?	What to use	Date context
Gmail (personal)	No	“Sign in with Google” (OAuth); app password only if the app cannot, and 2-Step Verification must be on	Password-only access from third-party apps ended 30 May 2022. App passwords are revoked when the Google password changes.
Google Workspace	No	“Sign in with Google”; app passwords if the admin allows them	“Less secure apps” access ended in spring 2025 (Google gave 14 March 2025 and later 1 May 2025)
Microsoft 365: IMAP, POP, Outlook, ActiveSync	No	Modern Authentication (OAuth)	Basic auth disabled in all tenants from 1 October 2022; cannot be re-enabled since 31 December 2022
Microsoft 365: SMTP AUTH	Still possible where enabled	OAuth preferred; SMTP AUTH must be enabled for the tenant or mailbox	Microsoft’s January 2026 update: basic auth for SMTP AUTH disabled by default for existing tenants at the end of December 2026 (admins can re-enable for now); final removal date to be announced in the second half of 2027
Microsoft 365 with security defaults on	No	Modern Authentication	Microsoft says POP3 and IMAP4 are automatically disabled when security defaults are enabled
Outlook.com (personal)	No	OAuth2 / Modern Auth	Microsoft’s Outlook.com settings page
iCloud Mail	No	App-specific password from your Apple Account (two-factor authentication required); Apple’s own apps sign in directly	Apple’s iCloud Mail server settings page
Zoho Mail	Yes, unless two-factor authentication is on	Mailbox password, or an app-specific password with two-factor authentication	Zoho help pages; check the settings for your account type
Fastmail	No	App password	Fastmail help pages
Proton Mail	Not applicable	Bridge-generated password	Proton Bridge guides
cPanel, Plesk, Enhance hosting mail	Yes	Mailbox password	Host dependent

Error messages and what they usually mean

Error	Where you see it	Usual cause
Username and password not accepted, 534-5.7.9 Application-specific password required	Gmail	App using the Google password instead of Sign in with Google or an app password
535 5.7.139 Authentication unsuccessful	Microsoft 365 SMTP	SMTP AUTH disabled, or basic auth blocked
550 5.7.30 Basic authentication is not supported for Client Submission	Microsoft 365 SMTP	Password-based SMTP no longer accepted for that mailbox
550 5.1.8 Access denied, bad outbound sender	Microsoft 365	Mailbox restricted for sending spam; see email account hacked
“Too many simultaneous connections”	Gmail	More than 15 clients connected
“Cannot verify server identity”	iPhone, Mac	Server name does not match the certificate
“Cannot Get Mail”, repeated password prompts	iPhone	Wrong password or wrong sign-in method
0x800CCC0E	Classic Outlook	Cannot reach the server: wrong name or port, or blocked network
Relay access denied, sender rejected	Any	Outgoing server authentication not switched on
Timeout on 465 and 587	Any	Network or firewall blocking the port

Bounce codes from other servers are decoded in the SMTP reply codes cheat sheet.

Where the settings live in each app

App	Path
iPhone and iPad (iOS 18 and later)	Settings, Apps, Mail, Mail Accounts, the account; outgoing under Account, Outgoing Mail Server (SMTP)
iPhone and iPad (earlier iOS)	Settings, Mail, Accounts, the account
Mac Mail	Mail, Settings, Accounts, the account, Server Settings
Classic Outlook for Windows	File, Account Settings, Server Settings (older versions: Account Settings, Change, More Settings, Advanced)
New Outlook for Windows and Outlook for Mac	Settings, Accounts; remove and re-add to change sign-in method
Thunderbird	Account Settings, Server Settings (incoming) and Outgoing Server (SMTP)
Android Gmail app	Settings, the account; for non-Google accounts, Account settings, Incoming and Outgoing settings

Saved passwords that will not go away: on Windows, Control Panel, Credential Manager, Windows Credentials; on a Mac, Keychain Access.

Auto-configuration records

Mail apps try to find settings on their own from DNS and well-known addresses. Wrong or stale records here cause repeated password prompts after a move.

Record	Looks like	Used by
autodiscover.example.com CNAME	autodiscover.outlook.com for Microsoft 365	Outlook, many phone apps
_autodiscover._tcp.example.com SRV	Priority, weight, port 443, target host	Outlook fallback; hosting panels often publish one
autoconfig.example.com	Serves /mail/config-v1.1.xml	Thunderbird and some others
_submission._tcp, _imaps._tcp, _pop3s._tcp SRV	Defined in RFC 6186 (and RFC 8314 for the TLS variants)	Some clients

dig autodiscover.example.com +short
dig _autodiscover._tcp.example.com SRV +short

Run in Terminal on your own computer. For Microsoft 365 the first should return autodiscover.outlook.com.; an IP address belonging to your web host means Outlook is being sent to the wrong place. The dig cheat sheet and the DNS lookup tool cover other lookups.

Test commands

All run in Terminal on your own computer (macOS or Linux). Replace mail.example.com with the server name.

Goal	Command	Good result
Is the port reachable?	nc -vz mail.example.com 465	“succeeded” or “open”; a timeout means a firewall is blocking it
Same, on Windows PowerShell	Test-NetConnection mail.example.com -Port 465	TcpTestSucceeded : True
Certificate on IMAP	openssl s_client -connect mail.example.com:993 -servername mail.example.com </dev/null	Verify return code: 0 (ok) and the name you use in the certificate
Certificate on SMTP 465	openssl s_client -connect mail.example.com:465 -servername mail.example.com </dev/null	As above, then a 220 greeting
STARTTLS on SMTP 587	openssl s_client -starttls smtp -connect mail.example.com:587 -servername mail.example.com </dev/null	Handshake completes and the certificate matches
Where mail for a domain goes	dig example.com MX +short	Your provider’s mail servers

The open ports tool runs the reachability test from outside your network, and the SSL checker shows a server’s certificate. The openssl cheat sheet explains the output in detail.

Gotchas

• Re-add, do not edit. When a provider changes its sign-in method, removing the account and adding it as the provider type (Google, Microsoft Exchange, iCloud) works far more reliably than editing a manual account.
• POP3 deletes from the server by default in many apps. Back up before removing a POP account, and prefer IMAP if you use more than one device.
• One device with an old password can get your office blocked. Hosting servers block IP addresses after repeated failed logins. Fix every device before asking the host to unblock you.
• Website mail is a separate setup. A WordPress SMTP plugin needs its own server, port and sign-in; see WordPress not sending email.
• After a website or DNS move, check MX and autodiscover first; see email stopped after changing nameservers.
• Microsoft 365 through GoDaddy sends sign-in to GoDaddy’s page; see moving Microsoft 365 away from GoDaddy.

Sources to check for changes

• Google: Gmail Help pages “Add Gmail to another email client” and “Read Gmail messages on other email clients using POP”, and Google Account Help “Sign in with app passwords”.
• Microsoft: POP3 and IMAP4 in Exchange Online, Deprecation of Basic authentication in Exchange Online, and the Exchange Team blog for SMTP AUTH dates.
• Apple: “iCloud Mail server settings for other email client apps”.
• Zoho, Fastmail and Proton: each provider’s IMAP or Bridge settings page.
• Standards: RFC 8314 (TLS for email submission and access) and RFC 6409 (message submission).