--- title: "Outlook IMAP Login Fails with Correct Password (DIGEST-MD5 on Plesk)" description: "Outlook can reject a correct IMAP password on Plesk when the server offers DIGEST-MD5. Confirm it in the mail log and limit Dovecot to PLAIN and LOGIN." url: "https://docs.noiz.ie/plesk/outlook-imap-login-fails-with-correct-password-digest-md5-on-plesk/" section: "Plesk" categories: - "Control Panels > Plesk > Plesk Troubleshooting" last_reviewed: "27 July 2026, against the Dovecot release shipped with Plesk" --- # Outlook IMAP Login Fails with Correct Password (DIGEST-MD5 on Plesk) ## Summary Some Microsoft Outlook clients (for example Office 2021 and Office 2024 LTS) fail to log in to a mailbox over **IMAP** even though the password is correct. Outlook shows a "check your credentials" or "cannot connect" error, yet webmail and Thunderbird sign in to the same mailbox without trouble. The cause is not the password: the mail server is advertising the legacy `DIGEST-MD5` authentication mechanism, Outlook tries it first, and it fails without reliably falling back to a mechanism that works. This guide shows you how to confirm the diagnosis from the mail log and how to remove the offending mechanism cleanly on a Noiz Plesk mail server. The same fix applies to the matching SMTP submission errors, because Plesk uses Dovecot for SASL authentication. **Last reviewed:** 27 July 2026, against the Dovecot release shipped with Plesk. This guide is written for Noiz hosting and is kept current against Dovecot and Plesk. It complements, and does not replace, the official Dovecot documentation linked below. ### Official Documentation Reference - [Dovecot: Authentication (SASL) Mechanisms](https://doc.dovecot.org/latest/core/config/auth/mechanisms/overview.html) (what `plain`, `login`, `digest-md5`, `cram-md5` and `apop` are) - [Dovecot: auth_mechanisms setting](https://doc.dovecot.org/latest/core/summaries/settings.html#auth_mechanisms) (the setting this guide changes) - [Plesk Obsidian change log](https://docs.plesk.com/release-notes/obsidian/change-log/) (the Dovecot release each Plesk update ships) ## Prerequisites - Root (or `sudo`) SSH access to the Noiz Plesk mail server. This is a server-wide change, so it is normally carried out by Noiz support rather than from the client area. - The affected mailbox address, so you can filter the log for it. - All commands below assume Plesk on Debian, where the mail log is `/var/log/maillog`. On some builds it is `/var/log/mail.log`. Throughout, replace `user@yourdomain.com` with the affected mailbox and `mail.yourdomain.com` with the mail host. These are examples to substitute, not literal values. ## Why Outlook fails when Thunderbird and webmail work When a client connects, the server advertises a list of authentication mechanisms it will accept. Outlook picks `DIGEST-MD5` from that list before it tries anything else, and its DIGEST-MD5 implementation does not interoperate cleanly with Dovecot. Instead of falling back to `PLAIN` over the already-encrypted TLS connection, Outlook reports a credentials failure. Thunderbird and webmail go straight to `PLAIN` or `LOGIN` over TLS, so they are never exposed to the broken path. That is why the same, correct password works everywhere except Outlook. ## Diagnosis ### 1) Show all IMAP authentication activity for the user ``` grep -F "imap-login" /var/log/maillog | grep -F "user=" ``` Compare failures against successes and look for the `method=` field on each line. ### 2) Highlight only the failing attempts ``` grep -F "imap-login" /var/log/maillog | grep -F "user=" | grep -i "auth failed" ``` A typical failing line looks like this: ``` dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts ...): user=, method=DIGEST-MD5, ... ``` ### 3) Summarise which mechanisms are being attempted ``` grep -F "imap-login" /var/log/maillog | grep -F "user=" | grep -o "method=[^,)]*" | sort | uniq -c ``` If you see a count for `method=DIGEST-MD5` alongside a working `method=PLAIN`, the Outlook/DIGEST-MD5 problem is confirmed. ### 4) Watch the log live while the user retries from Outlook ``` tail -f /var/log/maillog | grep -F "user=" ``` ### 5) Confirm what the server currently advertises ``` doveconf -n | grep -i "^auth_mechanisms" ``` On a stock Plesk build this typically returns a list that still includes the legacy mechanisms, which is what triggers Outlook's bad path: ``` auth_mechanisms = plain login digest-md5 cram-md5 apop ``` ## Resolution The fix is to restrict Dovecot to the modern mechanisms that Outlook, Thunderbird and webmail all use safely over TLS: `plain` and `login`. Do this with an override drop-in file so a future Plesk update to the default Dovecot configuration does not clash with your change. ### 1) Create an override drop-in Write a file in `/etc/dovecot/conf.d/` whose name sorts **after** Plesk's own auth configuration. Dovecot reads the files in this directory in alphabetical order and the **last** assignment of a setting wins, so a high-numbered prefix such as `99-` is what guarantees your value overrides the default. A `00-` prefix would load first and could be silently overwritten by Plesk's own `10-auth.conf`. ``` echo "auth_mechanisms = plain login" > /etc/dovecot/conf.d/99-noiz-auth-mechanisms.conf ``` Do not edit the Plesk-managed default files directly; a package update can replace them and undo your change. The drop-in keeps the override out of harm's way. ### 2) Reload Dovecot ``` systemctl reload dovecot # or, if reload does not pick up the change: systemctl restart dovecot ``` Existing sessions are unaffected; new logins use the restricted list. ### 3) Confirm the change took effect ``` doveconf -n | grep -i "^auth_mechanisms" ``` Expected output: ``` auth_mechanisms = plain login ``` This step is the real proof. If the line still shows `digest-md5`, your drop-in did not win the ordering. Rename it to a later-sorting name (a higher number prefix) and reload again. ### 4) Optionally verify the advertised capabilities over TLS ``` openssl s_client -connect mail.yourdomain.com:993 -crlf a CAPABILITY b LOGOUT ``` The pre-authentication capability line should no longer advertise `AUTH=DIGEST-MD5`. ### 5) Retest Outlook Ask the user to retry. Outlook should now authenticate using `PLAIN` over TLS and connect normally. No client-side reconfiguration is needed. ## Notes and context - This is a server-wide change affecting every mailbox on the host, for both IMAP/POP (Dovecot) and SMTP submission. Because Plesk uses Dovecot for SMTP SASL, submission errors that mentioned `DIGEST-MD5` also disappear once the override is in place. - Using `PLAIN` or `LOGIN` over TLS is the recommended modern approach. The credentials are protected by the TLS session, so there is no security downgrade in dropping the challenge-response mechanisms. The legacy `DIGEST-MD5`, `CRAM-MD5` and `APOP` mechanisms are obsolete and are the source of the Outlook interoperability problem. - Current Plesk releases ship a Dovecot release that still supports `DIGEST-MD5`. Plesk briefly disabled digest-md5 authentication in one update and then rolled that change back, so a Plesk update does not make this override redundant. Keep the drop-in in place, and check `doveconf -n` again after a major Plesk or Dovecot update. ## Troubleshooting - **doveconf still shows digest-md5 after reload**: the drop-in file is being overridden. Confirm it sorts alphabetically after every other file in `/etc/dovecot/conf.d/` that sets `auth_mechanisms` (use a higher number prefix), then reload Dovecot again. - **Outlook still fails after the change**: this points to a different cause. Rerun the diagnosis in step 3 and check the `method=` now being used. If `method=PLAIN` is failing, the password really is wrong or the mailbox is locked; if Outlook cannot connect at all, check the client is using SSL/TLS on port 993 for IMAP and 465 for SMTP. - **No lines match in the log**: the user may be connecting to a different server, or the log path is `/var/log/mail.log` on this build. Confirm the mail host against the account settings first. ## Need Noiz to make this change? This override is applied at server level, so it is not something you can set from the client area. If your Outlook clients are hitting this DIGEST-MD5 login failure on Noiz hosting, open a ticket from your [Noiz client area](https://www.noiz.co.za/clientarea.php) with the affected mailbox address and Noiz support will apply and verify the fix on the mail server for you. --- Source: https://docs.noiz.ie/plesk/outlook-imap-login-fails-with-correct-password-digest-md5-on-plesk/