iCloud Mail IMAP and SMTP Settings (Exact Values)

If you're adding iCloud Mail to Outlook, Thunderbird, or any client that isn't Apple's own Mail app, you need six exact values: two hostnames, two ports, a username format, and a password type that isn't your normal one.

Get any one of them wrong and the account either fails to connect or connects for incoming mail and then silently fails to send. Here they are, then what trips people up.

The short answer#

Before you start#

Three things have to be true before the settings above will work, and skipping any one of them produces a login error that looks like a typo but isn't.

• Two-factor authentication has to be turned on for your Apple Account — app-specific passwords don't exist as an option without it.
• Generate the app-specific password at account.apple.com under Sign-In and Security, not inside the mail client you're configuring.
• If the app you're connecting offers 'Sign in with Apple' instead of manual IMAP fields, use that — it skips app-specific passwords entirely. This only applies to direct IMAP/SMTP setup.
• Copy the 16-character password carefully; it's shown once, and hyphens or spaces pasted along with it will make an otherwise-correct password fail.
• You don't have to reuse the same app-specific password across every client. Apple allows up to 25 active at once, and generating a separate one per client means revoking Thunderbird later doesn't also break Outlook.

Steps: add the account with these values#

Most clients will try to auto-detect iCloud and fail, because iCloud isn't in the short list of providers with a built-in auto-config profile. Choose manual, advanced, or other setup instead of letting the client guess.

1. 1

   Start a manual IMAP account, not an auto-detected one

   In the client's add-account flow, look for "IMAP," "Advanced," or "Manual configuration" — auto-detect for an @icloud.com or custom-domain iCloud address usually times out or guesses Gmail-style servers.

2. 2

   Set the incoming (IMAP) server

   Host: imap.mail.me.com. Port: 993. Security: SSL/TLS (sometimes labeled "SSL"). Username: your full iCloud email address, including @icloud.com, @me.com, @mac.com, or your custom domain.

3. 3

   Set the outgoing (SMTP) server

   Host: smtp.mail.me.com. Port: 587. Security: STARTTLS (not implicit SSL). Authentication: on, using the same full email address as the username.

4. 4

   Enter the app-specific password when prompted

   Both the incoming and outgoing password fields take the same app-specific password — not your Apple Account password, and not two different passwords.

5. 5

   Map the special folders

   If the client asks which IMAP folder is Sent, Drafts, Trash, and Junk, point them at iCloud's own folders rather than leaving it on the client's local defaults. This is the step people skip, and then wonder why sent mail never shows up on their phone.

6. 6

   Expect iCloud's real folder names to differ from Apple Mail's labels

   On the IMAP server, iCloud's Trash folder is actually named "Deleted Messages" and its Sent folder is "Sent Messages" — Apple Mail relabels them for you, but a third-party client's folder-mapping screen shows the real names. Pick "Deleted Messages" for Trash and "Sent Messages" for Sent, not a client-created folder with a similar name.

7. 7

   Send a test email to yourself

   One round trip confirms both directions. If it sends but never arrives, the problem is almost always the folder mapping in the previous step, not the server settings.

Platform differences#

The values don't change by platform — imap.mail.me.com and smtp.mail.me.com are the same everywhere. What changes is how much of the setup the client does for you.

Client-specific setup notes#

The table above covers the shape of the problem per client. These are the details that matter once you're actually inside the account-setup screen.

• Classic Outlook for Windows: add the account as IMAP under File → Add Account → Advanced options → "Let me set up my account manually." Enter the incoming and outgoing values from the table above on the two separate screens Outlook shows for IMAP and SMTP — it will not infer the outgoing settings from the incoming ones.
• New Outlook for Windows and Outlook on the web: the manual-setup path is shorter, but the STARTTLS-vs-SSL default is the same trap. If the account connects for receiving but every send fails, reopen the account's server settings and confirm port 587 is paired with STARTTLS, not "SSL/TLS."
• Outlook for Mac: uses the same IMAP fields, but its "Add Email Account" screen defaults new accounts to Exchange autodiscovery first. Choose "IMAP/POP" explicitly from the account-type list before the server fields appear.
• Windows Mail app: after picking "Advanced setup → Internet email," it asks for incoming and outgoing servers on one screen with separate SSL checkboxes for each — check SSL for the incoming (993) server and leave the outgoing (587) box on STARTTLS rather than plain SSL.
• Android generic IMAP apps (K-9 Mail, FairEmail, and similar): choose "IMAP" as the account type, not "Exchange" or "Personal (IMAP)" auto-detect, since auto-detect for an @icloud.com address usually times out. The Gmail app can also host a non-Gmail IMAP account through its "Add another email account → Other" flow, using the same six values.

What to do when it doesn't work#

Decoding the exact error message#

The symptom table above maps the common failures to fixes. If you want to match your specific error text before you start changing settings, here's what the usual messages actually mean.

• Outlook's classic authentication failure shows as error code 0x800CCC92, with the text "Your email server rejected your login." This is Outlook's generic bad-credentials code for any IMAP or POP account, not something iCloud sends — it means the password field has the wrong value, almost always your Apple Account password instead of an app-specific one.
• Thunderbird shows a dialog titled "Login to server imap.mail.me.com failed" with a choice to retry, enter a new password, or cancel. Choosing "Enter new password" and pasting a freshly generated app-specific password resolves it in the large majority of cases; retrying with the same rejected password will fail the same way every time.
• "Cannot connect using SSL" or "cannot verify server identity" almost never means iCloud's certificate is invalid — Apple's own certificate is valid. It means the client picked implicit SSL for port 587 instead of STARTTLS, so the TLS handshake happens at the wrong point in the connection and the client blames the certificate instead of the mismatched setting.
• A generic "authentication failed" or "invalid credentials" message with no code, on any client, has the same two likely causes as the Outlook error above: a regular Apple Account password entered where an app-specific one belongs, or a previously working app-specific password that was revoked by a later Apple Account password change.
• If several failed attempts in a row trigger a temporary slowdown before you can try again, that's expected account-protection behavior on repeated bad logins, not a bug in the client — wait a few minutes, confirm you're pasting the app-specific password without a stray leading or trailing space, and try once more rather than retrying rapidly.

A faster way to keep this working#

These settings are a one-time cost, but they're not a zero-time cost: an app-specific password gets revoked when you change your Apple Account password, a client update resets a folder mapping, and every time that happens you're back in this menu.

AI Emaily connects to iCloud, Gmail, Outlook, and any IMAP account once and keeps the connection healthy — reconnecting after a revoked password prompts you rather than failing silently, and folder mapping is handled for you. On top of that it's an AI email client that triages, drafts, and closes loops across every account you connect, not just iCloud. We build AI Emaily, and it starts with a 7-day free trial.