POP3 and IMAP4 on Exchange Server: fixing NO LOGIN failed, missing banners and TLS errors

POP3 and IMAP4 aren't enabled on a new Exchange server, and when they're only half set up, clients report short errors such as NO LOGIN failed. or a connection that opens but never shows a banner. In this post I'll match each symptom to its cause on Exchange Server SE and Exchange 2019 (2016 behaves the same), fix it, and prove the fix with a test login and the protocol log.

Symptoms#

• The client can't connect to port 110, 995, 143 or 993 at all.
• The TCP connection opens, but no banner appears. Telnet shows only a blank screen, and Get-ServerComponentState lists PopProxy Inactive or ImapProxy Inactive.
• The banner appears, but sign-in fails even with the correct password:

* OK The Microsoft Exchange IMAP4 service is ready.
a1 LOGIN user@contoso.com ********
a1 NO LOGIN failed.

Variants include NO AUTHENTICATE failed. when the client uses AUTHENTICATE PLAIN, and -ERR Logon failure: unknown user name or bad password. for POP3, which Outlook shows inside its "Your email server rejected your login" error. With IMAP4 protocol logging turned on, a failed login records the reason:

...,login,user@contoso.com *****,"R=""a1 NO LOGIN failed."";Msg=Proxy:ex02.contoso.com:1993:SSL;ErrMsg=ProxyNotAuthenticated"

When the proxy components are offline, Microsoft documents this error: Microsoft.Exchange.Monitoring.ProtocolException: Authentication failed. The connection is being closed.

Why it happens#

Each protocol runs as two services. The front-end service (MSExchangePOP3 or MSExchangeIMAP4) accepts the client on 110/995 or 143/993. It then proxies the session to the back-end service (MSExchangePOP3BE or MSExchangeIMAP4BE) on the server that holds the active copy of the mailbox. That's the Proxy:ex02.contoso.com:1993:SSL part of the log line above. A break anywhere in that chain looks like a login problem. The usual causes:

• Services not running. Neither protocol is on by default, and the services aren't set to start automatically. Starting them only on the server clients connect to isn't enough: the back-end service must run wherever the mailbox can be active, which in a DAG means every member.
• Proxy components offline. If PopProxy or ImapProxy is Inactive in Get-ServerComponentState, the port answers but no banner appears. The services can still show as Running. Typical triggers are maintenance mode that was never ended, or Managed Availability taking the protocol offline with the HealthApi requester.
• Clear-text login on an unencrypted session. The default LoginType is SecureLogin: a plain-text password is accepted only after the session is encrypted (993/995, or STARTTLS on 143/110). A client set to 143 or 110 with no encryption fails.
• Certificate problems. X509CertificateName must match a name on a valid certificate. A single-name or SAN certificate must also be assigned to the IMAP or POP service; a wildcard certificate doesn't need to be.
• The account. The protocol is disabled on the mailbox, the password or user name format is wrong, or someone is testing with the Administrator mailbox, which Microsoft deliberately blocks for IMAP4 from Exchange 2016 onwards.

ErrMsg=ProxyNotAuthenticated means the front end couldn't complete the login against the back end. If the health mailboxes (HealthMailbox...) fail the same way in the log, the problem is on the server side; if only one user fails, look at that account.

How to fix it#

1. Start the services wherever they're needed#

# On every Exchange server that accepts clients or hosts mailbox copies
Set-Service MSExchangeIMAP4 -StartupType Automatic; Set-Service MSExchangeIMAP4BE -StartupType Automatic
Start-Service MSExchangeIMAP4, MSExchangeIMAP4BE
# Same for POP3 if you support it
Set-Service MSExchangePOP3 -StartupType Automatic; Set-Service MSExchangePOP3BE -StartupType Automatic
Start-Service MSExchangePOP3, MSExchangePOP3BE

To check every server from one shell:

Get-ExchangeServer | Where-Object IsMailboxServer | ForEach-Object {
  Get-Service MSExchangeIMAP4, MSExchangeIMAP4BE -ComputerName $_.Fqdn } |
  Format-Table MachineName, Name, Status, StartType -AutoSize

2. Bring PopProxy and ImapProxy back online#

Get-ServerComponentState -Identity EX01 | Where-Object Component -in 'PopProxy','ImapProxy'
(Get-ServerComponentState -Identity EX01 -Component ImapProxy).LocalStates

Release the hold with the requester that set it. For a HealthApi hold, Microsoft's fix is:

Set-ServerComponentState -Identity EX01 -Component ImapProxy -State Active -Requester HealthApi

A HealthApi hold means Managed Availability saw repeated probe failures, so also run Get-HealthReport -Identity EX01 | Where-Object HealthSet -like '*IMAP*'. My Managed Availability deep dive shows how to find the failing probe. If the requester is Maintenance, end maintenance mode properly instead; see patching a DAG without downtime.

3. Check the protocol settings#

Get-ImapSettings -Server EX01 | Format-List LoginType, X509CertificateName, *ConnectionSettings, *Bindings
Set-ImapSettings -Server EX01 -ExternalConnectionSettings "mail.contoso.com:993:SSL","mail.contoso.com:143:TLS" -X509CertificateName mail.contoso.com
Set-PopSettings -Server EX01 -ExternalConnectionSettings "mail.contoso.com:995:SSL","mail.contoso.com:110:TLS" -X509CertificateName mail.contoso.com

Leave LoginType at SecureLogin and configure the client for 993/995 with SSL/TLS, or STARTTLS on 143/110. Switching to PlainTextLogin makes the error go away by sending passwords in clear text. The external name needs a public DNS record, and the ports must be open on the firewall and load balancer.

4. Fix the certificate#

Get-ExchangeCertificate -Server EX01 | Format-List Thumbprint, CertificateDomains, Services, NotAfter
Enable-ExchangeCertificate -Server EX01 -Thumbprint <thumbprint> -Services POP,IMAP

The X509CertificateName value must appear in CertificateDomains. Microsoft recommends reusing the certificate you already use for the IIS services. Repeat the assignment after every renewal; see renewing the SAN certificate.

5. Check the account#

Get-CASMailbox user@contoso.com | Format-List PopEnabled, ImapEnabled
Set-CASMailbox user@contoso.com -ImapEnabled $true

Test with a normal user mailbox rather than Administrator, and try both the UPN and DOMAIN\username as the login name.

6. Restart the services#

The services read their settings at startup, so restart both after any change:

Restart-Service MSExchangeIMAP4, MSExchangeIMAP4BE
Restart-Service MSExchangePOP3, MSExchangePOP3BE

Verify the fix#

• Test-ImapConnectivity -ClientAccessServer EX01 -LightMode -MailboxCredential (Get-Credential) succeeds. Test-PopConnectivity takes the same parameters.
• From outside, the IMAP and POP email tests in the Microsoft Remote Connectivity Analyzer pass.
• From a machine with OpenSSL, openssl s_client -connect mail.contoso.com:993 -crlf -quiet shows * OK The Microsoft Exchange IMAP4 service is ready. and a LOGIN returns OK LOGIN completed.
• Outlook on the web shows the external settings under Settings › Options › Mail › Accounts › POP and IMAP.

For proof in the logs, turn on protocol logging, reproduce the login, read the newest files, then turn logging off again:

Set-ImapSettings -Server EX01 -ProtocolLogEnabled $true
Restart-Service MSExchangeIMAP4, MSExchangeIMAP4BE
Get-ChildItem (Join-Path $env:ExchangeInstallPath 'Logging\Imap4') | Sort-Object LastWriteTime |
  Select-Object -Last 2 | Select-String 'login'

In a good result the login line has no NO LOGIN failed. response and no ErrMsg; successful commands are logged as R=ok. POP3 uses Set-PopSettings -ProtocolLogEnabled and the Logging\Pop3 folder.

Prevent it next time#

• Keep SecureLogin and publish 993/995 only, unless a device genuinely needs STARTTLS.
• Add POP and IMAP to your certificate renewal checklist: assign the new certificate, then restart the services.
• After maintenance, check PopProxy and ImapProxy along with the other server components.

References#

• Enable and configure IMAP4 on an Exchange server (Microsoft Learn)
• Users cannot connect to POP3 or IMAP4 (Microsoft Learn)
• Set-ImapSettings (Microsoft Learn)