Your phone or Outlook keeps asking for the email password, or mail sits in the Outbox. Find out whether it is the password, the sign-in method, the server name or the port, and fix it.
Your iPhone pops up “Cannot Get Mail” and asks for the password again. Outlook shows a sign-in box every few minutes and never accepts what you type. Mail arrives, but replies sit in the Outbox. You checked the password three times and it works in webmail. Or someone told you to “use port 587” and now nothing works at all.
This is one of the most common email support requests, and it is rarely one single fault. A mail app needs four things to be right at the same time: the account, the sign-in method, the server name and the port with its matching encryption. Big providers have also stopped accepting plain passwords from mail apps, so a setup that worked for years can fail overnight without anything changing on your side. This guide walks through each layer in order, for the mail app on your phone or computer. If the problem is your website not sending email, see WordPress not sending email instead.
The email client settings cheat sheet lists the server names and ports for each common provider on one page.
A mail app talks to two separate services. IMAP (or the older POP3) fetches mail into the app. SMTP sends mail out. Each has its own server name, port, encryption setting and sign-in, and they fail independently: that is why you can receive but not send.
| Layer | What goes wrong | Typical symptom |
|---|---|---|
| Account | Password changed or expired, mailbox suspended, account locked after a compromise | Webmail also refuses the password |
| Sign-in method | Provider no longer accepts a plain password from apps; needs its own sign-in (OAuth, also called Modern Authentication) or an app password | Password correct in webmail, refused in the app, prompt repeats |
| Server name | Wrong host, or a name that does not match the server’s security certificate; autodiscover sends the app to the wrong server | Certificate warnings, or prompts that name an unexpected server |
| Port and encryption | Port and SSL/TLS or STARTTLS setting do not match; port 25 blocked by your internet provider | Cannot send, timeouts, “connection to the server failed” |
| SMTP authentication | “Outgoing server requires authentication” switched off | Relay denied or sender rejected when sending |
| Server protection | Too many failed attempts made the host’s firewall block your IP address | Every device in the office fails, but a phone on mobile data works |
| Port | Used for | Encryption setting in the app |
|---|---|---|
| 993 | IMAP, receiving | SSL/TLS (encrypted from the first byte) |
| 995 | POP3, receiving | SSL/TLS |
| 465 | SMTP submission, sending | SSL/TLS |
| 587 | SMTP submission, sending | STARTTLS (connects plain, then upgrades to encryption) |
| 25 | Server to server mail | Not for mail apps; many internet providers block it |
465 or 587? Both are correct for sending from an app, as long as the encryption setting matches the port. RFC 8314, the current standard on mail encryption, prefers encryption from the first byte (port 465) over STARTTLS, but still expects servers to offer both. In practice: use whatever your provider documents. If they offer both, 465 with SSL/TLS is a good default; if it fails on a particular network, try 587 with STARTTLS. The single most common mistake is pairing 465 with STARTTLS, or 587 with SSL/TLS, which fails every time.
dig example.com MX +short in Terminal (macOS or Linux), or Resolve-DnsName example.com -Type MX in PowerShell on Windows, replacing example.com with your email domain. Google, Microsoft, iCloud, Zoho, Fastmail and your web host each need different settings. The email diagnostic tool shows this in a browser.Open your provider’s webmail in a private browser window and sign in with exactly the same address and password the app uses.
Also check you are using the full email address as the user name. Most providers and hosts require it. (iCloud is an exception for IMAP; see the table in Step 2.)
This is the most common cause with big providers. They now want the app to open the provider’s own sign-in page, which handles MFA, instead of storing your password.
| Provider | What a mail app must use | Source and date context |
|---|---|---|
| Gmail (personal) | “Sign in with Google” in the app, or an app password if the app cannot do that (app passwords need 2-Step Verification on) | Google stopped accepting username and password sign-in from third-party apps on personal accounts on 30 May 2022. Google’s help says app passwords are “not recommended and are unnecessary in most cases”, and are revoked when you change your Google password. |
| Google Workspace | “Sign in with Google” (OAuth); app passwords only if your admin allows them | Google ended password-only access (“less secure apps”) for Workspace in spring 2025. Its admin help gave 14 March 2025 and a later Workspace Updates notice gave 1 May 2025 as the final date. |
| Microsoft 365 (business) | Modern Authentication (the Microsoft sign-in window) for IMAP, POP and Outlook | Microsoft disabled basic authentication for IMAP, POP, Exchange ActiveSync, EWS and Outlook in all tenants from 1 October 2022, and it cannot be re-enabled. SMTP AUTH with a password is separate: Microsoft’s January 2026 update says it will be disabled by default for existing tenants at the end of December 2026, with a final removal date to be announced in the second half of 2027. |
| Outlook.com, Hotmail (personal) | Modern Authentication (OAuth2) | Microsoft’s settings page lists OAuth2 as the authentication method for IMAP, POP and SMTP. |
| iCloud Mail | An app-specific password created in your Apple Account (requires two-factor authentication); Apple’s own Mail app signs in automatically | Apple’s iCloud server settings page |
| Zoho Mail | Your password, or an app-specific password if two-factor authentication is on; IMAP access must be enabled in Zoho settings | Zoho help pages (check the version for your account type) |
| Fastmail | An app password; your normal password is refused in mail apps | Fastmail help pages |
| Proton Mail | Proton Mail Bridge running on your computer, with the password Bridge generates | Proton’s Bridge guides; Proton says Bridge is available only with a paid plan |
| Web host mailboxes (cPanel, Plesk, Enhance) | The mailbox password | Your host’s mail client settings |
Editing the password field on an old manual account rarely fixes this. Remove the account and add it again as the provider type.
Removing and re-adding an IMAP account deletes the local copy only; the mail stays on the server. If you use POP3, mail may exist only on that device, so back it up first (or better, switch to IMAP).
For big providers, the account types above fill in the servers for you. For host mailboxes, take the names from the control panel, not from memory or a forum.
Why not just use mail.example.com? It may work, but the server’s security certificate has to cover that exact name. Many shared servers present a certificate for their own host name (such as server123.hostcompany.net), so mail.example.com triggers a “cannot verify server identity” warning, which on some apps turns into a password loop. Using the host name your panel shows avoids it. The downside is that if the host moves your account to another server, you must update the setting. Check what a server presents with the SSL checker or the openssl command in Step 6.
Check incoming and outgoing separately.
Open the account in Mail Accounts, tap the account line, then Outgoing Mail Server (SMTP), then the primary server. Set Use SSL on, Authentication to Password, and Server Port to 465 (or 587 if your provider says so). Check the user name and password are filled in for the outgoing server too; an empty outgoing password is a common reason mail sits in the Outbox. Incoming settings are under Advanced on the account screen: Use SSL on, port 993.
Go to File, Account Settings, then Server Settings (in older versions: Account Settings, select the account, Change, More Settings). For outgoing mail, check “My outgoing server (SMTP) requires authentication” and use the same settings as incoming mail. On the Advanced tab set incoming to 993 with SSL/TLS, and outgoing to 465 with SSL/TLS or 587 with STARTTLS. “Auto” sometimes picks the wrong pairing; choose explicitly.
Mail, Settings, Accounts, select the account, Server Settings. Uncheck “Automatically manage connection settings” to see the port and the “Use TLS/SSL” option.
If the app is set to send on port 25, change it. Many home and mobile internet providers block outgoing port 25 to stop infected computers sending spam, so sending simply times out. If 465 and 587 both time out on one network but work on another (for example on mobile data), that network or its firewall is blocking them; hotel and guest Wi-Fi often do this.
An app can keep trying an old saved password, or keep being sent to the wrong server, however many times you type the new one.
MicrosoftOffice for that address. Restart Outlook and sign in once.autodiscover.example.com to configure itself. If that record points at an old host or your web host while your mail is at Microsoft 365, Outlook connects to the wrong server and the prompt never ends. Check it:dig autodiscover.example.com +shortRun this in Terminal on your computer, replacing example.com. For Microsoft 365 the answer should start with autodiscover.outlook.com.. An IP address belonging to your web host is wrong. This often appears after a website move; email stopped after changing nameservers covers the repair. Microsoft’s Remote Connectivity Analyzer (testconnectivity.microsoft.com) can also run an Outlook autodiscover test.
If settings look right and it still fails, find out whether the server is reachable at all from where you are. These commands run in Terminal on your own computer (macOS or Linux). Replace mail.example.com with the server name from your settings.
nc -vz mail.example.com 993
nc -vz mail.example.com 465
nc -vz mail.example.com 587nc (netcat) tries to open a connection: -v prints the result and -z closes straight away without sending anything. Good: “succeeded” or “open”. Bad: “timed out” (blocked by a firewall on your network or the server) or “refused” (nothing listening on that port). On Windows use Test-NetConnection mail.example.com -Port 465 in PowerShell and look for TcpTestSucceeded : True. The open ports tool tests from outside your network, which tells you whether the block is local.
openssl s_client -connect mail.example.com:993 -servername mail.example.com </dev/null
openssl s_client -starttls smtp -connect mail.example.com:587 -servername mail.example.com </dev/nullThe first opens an encrypted IMAP connection; the second connects to port 587 and upgrades with STARTTLS (-starttls smtp). -servername asks for the certificate for that name, and </dev/null closes the connection once the handshake is done. In the output, look at the certificate subject and alternative names: they must include the host name you used. Good: Verify return code: 0 (ok). A name mismatch or self-signed certificate explains certificate warnings in your app. The openssl cheat sheet explains the rest of the output.
Hosting servers watch for repeated failed logins and block the IP address responsible for a while. One phone with an old password, retrying every few minutes, can get the whole office’s IP blocked. Signs: every device on the office network fails, webmail may not even load, but the same phone works on mobile data.
| Error | Most likely cause | Fix |
|---|---|---|
| “Cannot Get Mail. The user name or password … is incorrect” (iPhone) | Wrong password, or provider needs its own sign-in or an app password | Steps 1 and 2 |
Username and password not accepted or 534-5.7.9 Application-specific password required (Gmail) |
App is using your Google password | Re-add with Sign in with Google, or use an app password |
535 5.7.139 Authentication unsuccessful (Microsoft 365) |
SMTP AUTH disabled for the tenant or mailbox, or basic auth blocked by security defaults | Use Modern Authentication in the app; for devices that cannot, ask your admin (see Microsoft 365 setup) |
550 5.7.30 Basic authentication is not supported for Client Submission |
Microsoft no longer accepts a password for SMTP from that mailbox | Use an app that supports OAuth for sending |
| “Too many simultaneous connections” (Gmail) | More than the allowed number of apps connected; Google allows up to 15 email clients per account | Remove old devices and apps |
0x800CCC0E (classic Outlook) |
Outlook cannot connect to the server: wrong name, wrong port or blocked network | Steps 3, 4 and 6 |
| “Cannot verify server identity” | Certificate does not match the server name you typed | Use the host name your control panel shows (Step 3) |
| Mail stuck in Outbox, receiving fine | Outgoing port, encryption or SMTP authentication wrong | Step 4 |
Bounce with 552 or “mailbox full” |
The recipient’s or your own mailbox is over quota | Delete or archive mail; see bounce codes and full disk and quotas |
Contact your email provider or host with: the email address, the app and version (for example “iPhone Mail, iOS 18” or “Outlook for Windows, Microsoft 365 version”), the exact error text or a screenshot, the server names, ports and encryption you are using, whether webmail works, your public IP address, and the time of a failed attempt in UTC. That is enough for them to find your attempts in their logs.
If the prompts started right after an email migration, also read moving email without losing mail, which covers reconfiguring every device. If your Microsoft 365 was bought through GoDaddy and you are being sent to a GoDaddy sign-in page, see moving Microsoft 365 away from GoDaddy.
Did this fix it?
Still stuck? Start again from what you can see in the Emergency Room.
Still stuck?
Print a free one-page checklist to keep, or open the Emergency Room if the symptom does not match.
Get the free checklistsKeep reading
Search the field manual
Or jump straight to a symptom
Press / to search from any page, Esc to close