Email Server Settings Finder

About the Email Server Settings Finder

Setting up e-mail in an app means typing an incoming server (IMAP or POP3), an outgoing server (SMTP), a port and a security setting for each, and knowing which username and sign-in method the provider expects. This finder looks them up from the address alone, the way Thunderbird’s automatic setup does.

It first asks Thunderbird’s ISP database, the public list of settings for large providers. When the domain is not in it, it reads the domain’s MX records to see which provider receives its mail (Google Workspace and Microsoft 365 domains are found this way) and asks for that provider instead. Then it reads the domain’s own SRV records (RFC 6186, RFC 8314). You get each server with its port, security, username and sign-in method, notes on anything risky, and the steps to type them into Outlook, Mail on Mac, iPhone and iPad, Thunderbird or the Gmail app on Android.

Common uses

• Adding a work, school or hosting-provider mailbox to Outlook, Apple Mail, Thunderbird or a phone.
• Finding the SMTP server and port for a website, printer or scanner that sends e-mail.
• Checking which provider receives a domain’s mail before moving it.
• Checking that a domain’s SRV records advertise the right servers.

Ports and security

• IMAP: port 993 with SSL/TLS (encrypted from the start), or 143 with STARTTLS.
• POP3: port 995 with SSL/TLS, or 110 with STARTTLS.
• SMTP (sending): port 465 with SSL/TLS, or 587 with STARTTLS. Port 25 is for servers passing mail between each other.

RFC 8314 asks mail apps and providers to prefer SSL/TLS from the start over STARTTLS, and not to use unencrypted connections at all when an encrypted one exists. “SSL” in a mail app means TLS today; the name stuck.

Username and sign-in

Most providers want the full e-mail address as the username; some want only the part before the @, which the ISP database records with placeholders. The sign-in method is Normal password for most servers (sent inside the encrypted connection), or OAuth2, where the app opens the provider’s own sign-in page instead of storing your password. Providers that use OAuth2 only, such as Microsoft 365, refuse a password typed into the app; with two-step verification, some providers ask for an app password instead of your normal one.

IMAP or POP3?

IMAP keeps your mail on the server and shows the same folders on every device. POP3 downloads messages to one device, and many apps then remove them from the server. Choose IMAP unless you need POP3 for an old system.

How the search works

1. The ISP database file for the domain of the address.
2. If there is none, the provider that receives the domain’s mail: the most preferred MX host, then its parent domains, as Thunderbird does.
3. The domain’s SRV records: _submissions._tcp, _submission._tcp, _imaps._tcp, _imap._tcp, _pop3s._tcp and _pop3._tcp. A record with the target “.” says the service is not offered (RFC 6186 §3.4).
4. If nothing is published, the usual names (imap., mail., smtp., pop.) that exist in the domain’s DNS, marked as guesses.

A provider’s own autoconfig file or Autodiscover service is not asked: browsers let a web page read those only when the provider allows other websites to, and few do. Your mail app does ask them.

Limitations

• A browser cannot open mail-server connections, so the servers are not tested; your mail app tests them when you sign in.
• Settings found from MX records are the provider’s defaults; an organisation can turn IMAP or POP off, or give its own servers.
• The ISP database lists large providers; small hosts are found only if they publish SRV records or use usual server names.

Privacy

Sends data to online services

Your browser sends only the domain of the address, never the part before the @: to Thunderbird’s public ISP database (autoconfig.thunderbird.net), and to a public DNS-over-HTTPS resolver for the domain’s MX and SRV records.