I am trying to configure Outlook 365 (version 16.22.1) on Mac High Sierra (10.13.6). The Mac is a domain member on a Windows Active Directory domain. Our office has a self-hosted IMAP mail server running Dovecot. Dovecot works just fine with Thunderbird and A/D authentication kerberos/GSSAPI. I'm trying to set Outlook up to use the Dovecot/IMAP server.

In Outlook, when I click 'Add Account', then enter the email address, it defaults to "Exchange". Selecting 'Not Exchange' gives me a list of other providers (Google, iCloud, etc.) and an IMAP choice. The IMAP choice only provides for ID/PW authentication, no kerberos.

Going back to Exchange (even though the server is not Exchange), I have a choice of methods, 'User name and password', 'kerberos' or 'Client Certificate Authentication'. I select kerberos. I fills in my kerberos ID which, according to Microsoft, I assume is correct. It asks me for my server which is mail.hprs.local.

I then get a pop-up saying, "Outlook was redirected to the server mail.ohprs.org to get new settings for your account myname@ohprs.org. Do you want to allow this server to configure your settings?" This is NOT the server I want to use to configure my settings, so I answer 'Always deny', whereupon it fails with, "Unable to connect to the server.Please try again', and no account is created.

If instead I answer, 'Always Allow', it fails with the same message.

With Thunderbird I have a manual configure page where I could set in/out servers, ports, authentication mechanism and TLS, etc. I'm not getting that far with Outlook.

Is there a way to do what I want?

migrated from serverfault.com Feb 23 at 9:36

This question came from our site for system and network administrators.


According this Microsoft article, Outlook for Mac supports Kerberos protocol as a method of authentication with Microsoft Exchange Server and standalone LDAP accounts. However, as you use Dovecot/IMAP server, I’m afraid it doesn’t support for your scenario.

With Kerberos/GSSAPI, the account would have no password. If you want to use Outlook, I think you may try to use normal IMAP protocol with Username/Password.

  • "With Kerberos/GSSAPI, the account would have no password. " That's correct, authentication is done via Active Directory authentication. This works just fine with Thunderbird, but apparently Outlook doesn't have a way to change server, ports or security mechanism. NTLM does not work with Dovecot. So, I guess you're right, unless someone else has a suggestion. I'll have to use user/PW, which kind of sucks since this is an Active Directory domain. – Mark Foley Feb 22 at 18:38

Maybe use something like Automx to assist in autodiscover? Outlook is going to try and find configuration from somewhere, I'm not sure how it plays with Dovecot.

  • Thanks, but I don't think that will work. Automx says, "... provide is real name, mail address and password." That's basically what Outlook is doing. The problem is that this is an intra-LAN Mail Delivery Agent and the email address domain: ohprs.org is not handled by the internal MDA, so anything Outlook (or probably automx) figures out based on the email address domain will be wrong. I need is a way to override incoming and outgoing servers, ports and security so that it looks only at the local server: mail.hprs.local, not at the public server ohprs.org. Is that possible with Outlook? – Mark Foley Feb 22 at 4:43

I'm going to consider that this is not doable. I believe I agree with Shaw in that kerberos authentication from Outlook is intended for Exchange, no other email servers exist in the Microsoft universe. Therefore, I am reverting to the IMAP ID/PW mechanism, which is rather sad since even Thunderbird is able to do Active Directory authentication via kerberos on the Mac. Oh well.

I'm considering this issue close. As I am relatively new to this forum I am not familiar with the secret handshakes involved to mark this question as closed, nor do I see anything obvious on the page itself. So, if any reader is able and willing to do so, or would like to tell me how, please do.

Thanks All!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.