I use IMAP and I only access my email through SSL.

However, the settings for encrypted email access seem a bit more complicated that https. Can someone explain the security implications of the different combinations? I'll use the available settings from Thunderbird as an example:

IMAP security:

  • Connection: None | STARTTLS | SSL/TLS
  • Authentication: Normal password | Encrypted Password | Kerberos | NTLM | TLS Certificate

SMTP security:

the same

I have put the options I use at one of my addresses in bold. I'm specifically interested if this combination is secure, but an outline of what the other stuff means would also be great!

  • just note encrypted email access is not email encryption, I hope your question is what you are asking. ;) Sep 22, 2015 at 20:40
  • Good, just wanted to be sure. Sep 24, 2015 at 11:41

1 Answer 1



Select STARTTLS or SSL/TLS on connection. Unless told otherwise by your administrator use normal password on authentication.

If your connection is secure, the password may be sent unencrypted through the encrypted connection.

If the connection is not secure, using a secure authentication keeps your password protected. But it may allow an attacker to take over your tcp-connection and do anything within the connection that you can do: read mails, move them around, delete them, flag them, etc.


none: Unencrypted connection, do not use

ssl/tls: Start a secure connection on a IMAP port dedicated to secure connections (993). This is similar to https.

starttls: The connection is done on the traditional IMAP port (143) but one of the first commands is STARTTLS, which means starting encryption just like TLS/SSL.


Normal password: Unencrypted password. This is okay, on a secure connection

Encrypted Password: The password is encrypted somehow. There are different standards.

Kerberos: Kerberos is a single sign on infrastructure. If your computer and the mailserver are member of the same trust domain, Kerberos allows you to access you mails based on your operating system domain login.

NTLM: Similar to Kerberos but Microsoft specific

TLS Certificate: In most cases only the server has a key pair and a certificate to prove its identity. But this approach can be applied on the client as well. That's especially interesting if the private key is stored on a smart card.

  • Excellent! So it seems I'm using the default/OK configuration alright.
    – Martin
    Oct 3, 2011 at 11:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .