Diagnose email server connectivity issues
Email programs can report username / password error for issues not actually related to those being wrong, when in fact there are different server connectivity issues. Testing server connectivity through a command line interface can deliver a more precise error message than provided by most email clients. The following describes how to do this using cURL commands which are a convenient means of testing server connectivity and diagnosing issues.
This process is not difficult, but you will need the following resources which might be unfamiliar...
- Windows: POWERSHELL window (NOT CMD / DOS window) - right click on the Windows Start button to open the context menu and select
- Win 11 - TERMINAL (not Admin)
- Win10 - Windows Powershell (not Admin)
- macOS: TERMINAL window - open through Spotlight (cmd +space) or navigate in Finder to '/Applications/Utilities/Terminal.app'
- Linux: You might need to update curl
WARNING: the Firefox browser has various characteristics not seen with the majority of modern browsers - the automation on this page will not work with that browser post version 135. Please use something different!
Email server configurations
An email account connects to two components: inbound (IMAP or POP3) and outbound (SMTP) servers. Those connections can be with and without encryption, which for the inbound servers means different ports.
Each email brand has its own sets of differing server names some supporting encryption and in some cases not. These have been documented in various forum support pages but are not now guaranteed to be correct; those documented here have been tested to affirm their accuracy.
The server names listed below match those in the security certificates; others might work (without encryption) but will encounter 'certificate' issues if encryption is set. Similarly other ports might work, but those documented below are the correct ones. Where encryption is supported it should be TLS/SSL on the inbound server (IMAP / POP3) and STARTTLS for the outbound server (SMTP).
curl diagnostic commands
To save the complexity of explaining how to use cURL for each of the brands the commands below have been pre-configured to test IMAP, POP3 and SMTP servers, with and without encryption as applicable for each brand. All you need to do is...
- Choose your environment - Windows or Other
- Enter your email address (or userID)
- Select the appropriate email brand from the options shown
For your convenience after selecting the email brand, the relevant cURL commands will be copied to your clipboard, AFTER acknowleding the prompt.
After acknowledging the prompt, paste the clipboard into the TERMINAL window. The commands will execute in turn. When prompted type your password, note that this is NOT echoed back to the screen, remember to press enter. Note the results.
These commands are configured to test / adopt best practice: if encryption is available for the selected service, it will be used for the diagnostic test; the correct port will be used even if an incorrect alternative works.
userID
For fool proof testing the, preferred userID (as specified), should be used for each email brand. Other forms of ID may be tried for each server but might or might not work depending on the brand.
- Address - Mailbox email address as applicable
- you@branddomain.tld
- you@youraccount.branddomain.tld
- you@yourdomain.tld may also work
- Account
- account-name for the default mailbox
- account-name+mailbox for secondary mailboxes
Understanding the results
These diagnostic tests deliver a useful amount of useful information which will clarify the real issue being encountered. WARNING: The information returned contains the following information which would be unwise to share on a public forum:
- Your IP address - possibly not too much of an issue if it is dynamic, but a static one you will probably want to keep secret
- The encrypted versions of your username and password (long strings of text) which can easily be decrypted - NEVER share these here
- Plain text versions of your username and password - NEVER share these here
Though the detailed output for the various servers is different, they all have a similar structure:-
- Identification of the server and the target port number
- The IP address resolution (IPv4 and IPv6)
- The selected IP address for the test followed by the connection confirmation
- Server greeting and capability statements
- Log on dialogue
- Success / failure indicators
SMTP
SMTP returns a 235 or 535 response with a clear indication of the status, such as:
- 235 ... authentication succeeded
- 235 2.0.0 OK
- 535 ...authentication rejected [userID / password wrong]
- 535 5.7.0 Invalid login or password
- 535 ...authentication rejected as source IP has a poor reputation
- 535 Too many SMTP auth failures. Please try again later
A poor reputation issue arises from historic abuse of the allocated dynamic IP address. Resolution requires a forced change of the allocated address - switch the router off for two hours and try again.
Too many failures means you have made too many attempts to get the credentials right - give it a break and try again after a couple of hours.
IMAP
If the IMAP connection fails (Access Denied) then check the userID and password.
A successful connection will produce a list of the folders in the mailbox.
POP3
POP3 is fairly clear with its reason for the failure … however that is not the same as the cause of the failure:-
- -ERR Login failed - check userID and password
- -ERR internal server error - needs further investigation - post a sanitised copy of the response text
A successful connection will produce a numerical list referencing each mail item in the inbox folder.
Revised: 13 May 2025 13:54
