GMX IMAP Settings: Enable Access Before You Configure Anything

GMX's IMAP settings are imap.gmx.com on port 993 with SSL/TLS encryption, and its SMTP settings are mail.gmx.com on port 587 with STARTTLS. Those two lines are correct, and they still won't work the first time you try them.

That's because GMX ships POP3 and IMAP access turned off by default. Every email client — Outlook, Apple Mail, Thunderbird, a phone's default Mail app, or a service like Gmail's "import from another account" — connects the same way a hacker's script would: it authenticates over IMAP or POP3 and asks for your inbox. GMX blocks that path entirely until you flip one switch inside your GMX account. Get the server settings perfect and skip that switch, and you'll still see an authentication failure with no obvious cause listed.

It's a reasonable default, not a bug. Leaving third-party protocol access open by default would mean any script that guessed a GMX password could pull mail without ever touching GMX's own login page or its two-factor prompt. Requiring an explicit opt-in, and a separate app password once you turn on two-factor authentication, narrows that door to only the apps you actually chose.

This post covers the toggle, the exact server values, where IMAP and POP3 diverge, what changes on a phone versus a desktop client, and what each specific rejection actually means when the settings you typed are already correct.

Before you start#

A few things save you a repeat trip through your client's setup wizard.

• Username is your full GMX address, not just the part before the @ — [email protected], not someone.
• If you've turned on two-factor authentication, your regular GMX password will not work in a mail client. You need a separate application-specific password, generated once and used only for that app.
• Only TLS 1.2 and 1.3 are accepted. GMX stopped supporting TLS 1.0 and 1.1, so a very old client or an unpatched operating system can fail here even with the right hostname and port.
• IMAP and POP3 are activated together in the same setting, but they are still two different protocols with two different servers — enabling one does not choose which your client uses.
• On a phone, the built-in Mail app usually has a preset "GMX" or "Other" account type that fills in the server fields for you. That preset still won't authenticate until the toggle above is on, so a failed setup on iOS or Android points back to the same fix as a failed setup in Outlook.
• GMX also caps how many mail clients can hold an active IMAP connection to the same mailbox at once. Setting up a phone, a laptop, and a webmail session at the same time isn't the problem — normal use of two or three clients is fine — but a script or an old, abandoned client left connected in the background can quietly eat that budget and make a brand-new setup fail with what looks like a login error.

Steps: turn on IMAP access, then connect your client#

1. 1

   Turn on external access inside GMX

   Log in to GMX on the web, then go to Email → Settings → POP3 & IMAP, and turn on "Send and receive emails via external program." This is the step that's missing more often than any server setting.

2. 2

   Note your address and, if 2FA is on, generate an app password

   If two-factor authentication is enabled, create an application-specific password on that same settings page before you touch your mail client. Write it down immediately — GMX shows it once.

3. 3

   Add the account in your mail client as IMAP, not POP3

   Most clients ask you to choose a protocol during setup, or default to one silently. Pick IMAP if you want your mailbox to stay in sync across your phone, laptop, and webmail at once. In Outlook (Windows or Mac), choose "Advanced setup" → "IMAP" rather than letting Outlook's auto-detect pick a protocol for you. In Thunderbird, the account wizard runs its own auto-config lookup against gmx.com first — if it comes back with the right hostnames, confirm IMAP is selected before clicking "Done"; if it fails or times out, click "Manual config" and type in the values from the next two steps yourself. Apple Mail's "Other Mail Account" flow asks for the incoming and outgoing servers on separate screens, which is also where people accidentally leave SMTP on Apple's default port instead of 587.

4. 4

   Enter the incoming (IMAP) server

   Server: imap.gmx.com. Port: 993. Security: SSL/TLS (sometimes labeled "SSL" in older clients).

5. 5

   Enter the outgoing (SMTP) server

   Server: mail.gmx.com. Port: 587. Security: STARTTLS. Authentication is required — leave "my server requires authentication" checked and reuse the same username and password.

6. 6

   Send a test email to yourself

   A successful send-and-receive round trip confirms both directions are actually working, not just that the client accepted the settings. Some clients accept a bad SMTP password silently and only fail the first time you actually try to send.

GMX server settings: IMAP vs. POP3 vs. SMTP#

If you're deciding between IMAP and POP3 rather than just following a setup wizard, the practical difference is what happens to your mail after you read it. IMAP leaves it on GMX's servers and mirrors it everywhere you check mail; POP3 downloads it to one device and, depending on your settings, can remove it from the server. For anyone using more than one device, IMAP is the setting to pick.

SMTP isn't a choice — every setup needs it, since IMAP and POP3 only cover receiving mail. If a client's wizard walks you through incoming settings and then just says "done," go back and confirm the outgoing server was actually filled in; a client that silently defaults SMTP to the wrong port is a common reason mail arrives but never sends.

What to do when GMX still rejects your login#

Getting an authentication error after entering the settings above almost always traces back to one of four things, and they're worth checking in this order.

• POP3/IMAP access is still off — this is the single most common cause. Go back to Email → Settings → POP3 & IMAP and confirm the external-program toggle is actually on, not just that you visited the page.
• You're using your normal password with two-factor authentication turned on. Generate an application-specific password instead; your account password will be silently rejected here even though it works for GMX webmail.
• The username is missing the domain. "someone" fails where "[email protected]" succeeds — some clients pre-fill only the local part from your display name.
• The port or encryption type is mismatched — port 993 needs SSL/TLS selected, not STARTTLS, and port 587 needs STARTTLS, not SSL/TLS. Swapping them produces a connection timeout rather than a login error, which is a useful tell.

Reading the specific error your client shows#

The generic advice above covers most cases, but the exact wording a client puts on screen narrows it further, and it's worth matching your error to one of these before retyping every field from scratch.

• "Authentication failed" or "Incorrect username or password" — GMX accepted the connection but rejected the credentials. This is almost always the 2FA/app-password issue or a missing @gmx.com in the username, not a wrong server or port.
• "Cannot connect to server" or a connection that just times out — the client never reached GMX at all. Check the hostname spelling first (imap.gmx.com, not imap.gmx.net or gmx.com alone), then check that the port and encryption type are paired correctly, since a mismatch there often reads as a dead connection rather than a rejection.
• "Certificate could not be verified" — usually a clock that's badly out of sync on the device, or, on an older operating system, a client that can no longer negotiate TLS 1.2 or 1.3. Correcting the system date and time fixes this more often than reinstalling the mail app does.
• The client accepts the incoming (IMAP) server without complaint but then fails only when you try to send — that isolates the problem to the SMTP fields specifically. Re-check that outgoing authentication is enabled and set to use the same username and password as the incoming server, since some setup wizards leave it unauthenticated by default.

A faster way than re-checking settings every time something breaks#

None of the above is complicated once — it's the second and third time a GMX login mysteriously fails, on a new laptop or after GMX rotates a security requirement, that gets old. Connecting GMX through AI Emaily skips the manual IMAP/SMTP form entirely: you authorize the account once and the connection, retries, and reconnects after a password or 2FA change are handled for you.

We build AI Emaily. It's an AI-native email client that also triages, drafts replies in your own voice, and asks before it sends anything — but the part relevant here is simply that GMX (and any other IMAP provider) connects in one step instead of six fields.