Outlook IMAP Login Fails with Correct Password (DIGEST-MD5 on Plesk)

Summary

Some Microsoft Outlook clients (for example Office 2021 and Office 2024 LTS) fail to log in to a mailbox over IMAP even though the password is correct. Outlook shows a "check your credentials" or "cannot connect" error, yet webmail and Thunderbird sign in to the same mailbox without trouble. The cause is not the password: the mail server is advertising the legacy DIGEST-MD5 authentication mechanism, Outlook tries it first, and it fails without reliably falling back to a mechanism that works.

This guide shows you how to confirm the diagnosis from the mail log and how to remove the offending mechanism cleanly on a Noiz Plesk mail server. The same fix applies to the matching SMTP submission errors, because Plesk uses Dovecot for SASL authentication.

Last reviewed: 27 July 2026, against Dovecot 2.3.x as shipped with Plesk (current stable in the Plesk repositories). This guide is written for Noiz hosting and is kept current against Dovecot and Plesk. It complements, and does not replace, the official Dovecot documentation linked below.

Official Documentation Reference

• Dovecot: Authentication Mechanisms (what plain, login, digest-md5, cram-md5 and apop are)
• Dovecot: Core settings reference (the auth_mechanisms setting)

Prerequisites

• Root (or sudo) SSH access to the Noiz Plesk mail server. This is a server-wide change, so it is normally carried out by Noiz support rather than from the client area.
• The affected mailbox address, so you can filter the log for it.
• All commands below assume Plesk on Debian, where the mail log is /var/log/maillog. On some builds it is /var/log/mail.log.

Throughout, replace [email protected] with the affected mailbox and mail.yourdomain.com with the mail host. These are examples to substitute, not literal values.

Why Outlook fails when Thunderbird and webmail work

When a client connects, the server advertises a list of authentication mechanisms it will accept. Outlook picks DIGEST-MD5 from that list before it tries anything else, and its DIGEST-MD5 implementation does not interoperate cleanly with Dovecot. Instead of falling back to PLAIN over the already-encrypted TLS connection, Outlook reports a credentials failure. Thunderbird and webmail go straight to PLAIN or LOGIN over TLS, so they are never exposed to the broken path. That is why the same, correct password works everywhere except Outlook.

Diagnosis

1) Show all IMAP authentication activity for the user

grep -F "imap-login" /var/log/maillog | grep -F "user=<[email protected]>"

Compare failures against successes and look for the method= field on each line.

2) Highlight only the failing attempts

grep -F "imap-login" /var/log/maillog | grep -F "user=<[email protected]>" | grep -i "auth failed"

A typical failing line looks like this:

dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts ...): user=<[email protected]>, method=DIGEST-MD5, ...

3) Summarise which mechanisms are being attempted

grep -F "imap-login" /var/log/maillog | grep -F "user=<[email protected]>" | grep -o "method=[^,)]*" | sort | uniq -c

If you see a count for method=DIGEST-MD5 alongside a working method=PLAIN, the Outlook/DIGEST-MD5 problem is confirmed.

4) Watch the log live while the user retries from Outlook

tail -f /var/log/maillog | grep -F "user=<[email protected]>"

5) Confirm what the server currently advertises

doveconf -n | grep -i "^auth_mechanisms"

On a stock Plesk build this typically returns a list that still includes the legacy mechanisms, which is what triggers Outlook's bad path:

auth_mechanisms = plain login digest-md5 cram-md5 apop

Resolution

The fix is to restrict Dovecot to the modern mechanisms that Outlook, Thunderbird and webmail all use safely over TLS: plain and login. Do this with an override drop-in file so a future Plesk update to the default Dovecot configuration does not clash with your change.

1) Create an override drop-in

Write a file in /etc/dovecot/conf.d/ whose name sorts after Plesk's own auth configuration. Dovecot reads the files in this directory in alphabetical order and the last assignment of a setting wins, so a high-numbered prefix such as 99- is what guarantees your value overrides the default. A 00- prefix would load first and could be silently overwritten by Plesk's own 10-auth.conf.

echo "auth_mechanisms = plain login" > /etc/dovecot/conf.d/99-noiz-auth-mechanisms.conf

Do not edit the Plesk-managed default files directly; a package update can replace them and undo your change. The drop-in keeps the override out of harm's way.

2) Reload Dovecot

systemctl reload dovecot
# or, if reload does not pick up the change:
systemctl restart dovecot

Existing sessions are unaffected; new logins use the restricted list.

3) Confirm the change took effect

doveconf -n | grep -i "^auth_mechanisms"

Expected output:

auth_mechanisms = plain login

This step is the real proof. If the line still shows digest-md5, your drop-in did not win the ordering. Rename it to a later-sorting name (a higher number prefix) and reload again.

4) Optionally verify the advertised capabilities over TLS

openssl s_client -connect mail.yourdomain.com:993 -crlf
a CAPABILITY
b LOGOUT

The pre-authentication capability line should no longer advertise AUTH=DIGEST-MD5.

5) Retest Outlook

Ask the user to retry. Outlook should now authenticate using PLAIN over TLS and connect normally. No client-side reconfiguration is needed.

Notes and context

• This is a server-wide change affecting every mailbox on the host, for both IMAP/POP (Dovecot) and SMTP submission. Because Plesk uses Dovecot for SMTP SASL, submission errors that mentioned DIGEST-MD5 also disappear once the override is in place.
• Using PLAIN or LOGIN over TLS is the recommended modern approach. The credentials are protected by the TLS session, so there is no security downgrade in dropping the challenge-response mechanisms. The legacy DIGEST-MD5, CRAM-MD5 and APOP mechanisms are obsolete and are the source of the Outlook interoperability problem.
• Recent Dovecot releases (2.4 and later) have removed DIGEST-MD5 and other legacy mechanisms entirely. If a future Plesk update moves the server onto Dovecot 2.4 or newer, this failure can no longer occur and the override simply becomes redundant, not harmful.

Troubleshooting

• doveconf still shows digest-md5 after reload: the drop-in file is being overridden. Confirm it sorts alphabetically after every other file in /etc/dovecot/conf.d/ that sets auth_mechanisms (use a higher number prefix), then reload Dovecot again.
• Outlook still fails after the change: this points to a different cause. Rerun the diagnosis in step 3 and check the method= now being used. If method=PLAIN is failing, the password really is wrong or the mailbox is locked; if Outlook cannot connect at all, check the client is using SSL/TLS on port 993 for IMAP and 465 for SMTP.
• No lines match in the log: the user may be connecting to a different server, or the log path is /var/log/mail.log on this build. Confirm the mail host against the account settings first.

Need Noiz to make this change?

This override is applied at server level, so it is not something you can set from the client area. If your Outlook clients are hitting this DIGEST-MD5 login failure on Noiz hosting, open a ticket from your Noiz client area with the affected mailbox address and Noiz support will apply and verify the fix on the mail server for you.