Yahoo IMAP Settings for Mail Clients in 2026

Do not index

Correct server values are the easy half of Yahoo IMAP setup, and they are rarely the half that fails. A client can hold the right hostname, the right port, and the right encryption and still get a login rejection, because Yahoo refuses the credential rather than the connection. A web password where an app password is required, a stale app password, a TLS mode paired with the wrong port, or the export host entered where the sync host belongs all produce errors that look like typos in the server fields. The fix starts with knowing which half broke.

Table of Contents

What Are the Yahoo IMAP Settings Why the port and encryption must match One set of values for ordinary Yahoo Mail What Each Yahoo Server Field Means The username field The encryption field Which Yahoo IMAP Host to Use Sync host versus export host When Yahoo Mail Needs an App Password How to generate an app password How long an app password stays valid How to Add Yahoo Mail in a Client The manual setup sequence Where client interfaces differ Why Yahoo IMAP Authentication Fails Reading the failure in order How to Verify the Yahoo Connection How to verify it Frequently Asked Questions About Yahoo IMAP Settings Does Yahoo IMAP still use port 993 in 2026?Can the Yahoo account password be used in Outlook or Thunderbird?Does changing the Yahoo password update the mail app?Is there a different IMAP server for another country or a partner-managed mailbox?

What Are the Yahoo IMAP Settings

Yahoo Mail's incoming server is imap.mail.yahoo.com on port 993 with SSL/TLS, and the username is the complete Yahoo email address. The Yahoo IMAP settings page lists that hostname, port 993, SSL encryption, and full-address login as the standard configuration. Outgoing mail needs a separate server entry, smtp.mail.yahoo.com, using either port 465 with SSL/TLS or port 587 with STARTTLS.

Direction	Hostname	Port	Encryption	Username
IMAP incoming	imap.mail.yahoo.com	993	SSL/TLS	Full Yahoo email address
SMTP outgoing, implicit TLS	smtp.mail.yahoo.com	465	SSL/TLS	Full Yahoo email address
SMTP outgoing, STARTTLS	smtp.mail.yahoo.com	587	STARTTLS	Full Yahoo email address

Why the port and encryption must match

Port 993 is the encrypted IMAP port. A client shouldn't attempt an unencrypted connection on that port for normal Yahoo Mail access, because the server expects TLS from the start of the session. Entering 993 while leaving encryption set to none, or to an upgrade mode meant for a different port, produces a connection or TLS failure even though the hostname looks right.

The same pairing logic applies on the sending side. Port 465 pairs with SSL/TLS, and port 587 pairs with STARTTLS. Mixing those pairs is one of the most common reasons folders sync correctly while sending fails, since the incoming side can be perfect while the outgoing side never completes its handshake.

One set of values for ordinary Yahoo Mail

These incoming values apply globally to ordinary Yahoo Mail accounts. Yahoo publishes the same incoming server across its help documentation for desktop, mobile, and general mail access, so Outlook, Thunderbird, a phone mail app, and custom software all start from the same host. There's no separate public hostname to hunt for by device type.

Partner-managed mailboxes are the exception worth pausing on. If an employer, internet provider, or other partner administers the mailbox, or if Yahoo has updated a help page, the hostname should be confirmed in Yahoo's official documentation before anyone assumes a second public server exists. Guessing a regional variant wastes diagnostic time.

For a lookup that doesn't require a password, the mailX IMAP finder returns the incoming server, ports with encryption, and login requirements for providers including Yahoo. That confirms the server fields without submitting any credential, which makes it a safe first check before a client is touched.

What Each Yahoo Server Field Means

IMAP, or Internet Message Access Protocol, is the protocol that retrieves and synchronizes mail from Yahoo. It works in two directions. Reading, deleting, moving, or filing a message in a third-party client is reflected in Yahoo Mail on the web and on every other connected device, because the mailbox lives on the server and each client mirrors it.

SMTP, or Simple Mail Transfer Protocol, does the opposite job. SMTP only sends. An application that only needs to read Yahoo mail, such as a monitoring script or an archive tool, shouldn't point its outgoing server at the SMTP host and expect folders to appear. Confusing the two protocols is a quiet setup error, since both fields sit side by side in most account screens.

The username field

The username is the full Yahoo address, including the domain, such as @yahoo.com, @ymail.com, or @rocketmail.com. The part before the @ sign alone doesn't authenticate. This trips up admins coming from corporate systems where a short login name is normal, and it produces an error that looks identical to a wrong password.

The encryption field

Encryption modes describe when the session becomes private:

Implicit SSL/TLS on ports 993 and 465: The connection is encrypted from the first byte, before any login data moves.

STARTTLS on port 587: The session opens in plain text, then upgrades to encryption before credentials are sent.

Ports to avoid: Port 143 and port 25 aren't substitutes for Yahoo IMAP or Yahoo SMTP in a mail client setup.

The diagnostic split follows from these definitions. Folders loading while sending fails points at the outgoing server. Sending working while folders never sync points at the incoming server. Reading the failure that way tells an admin which half of the account screen to reopen.

A successful Yahoo webmail login doesn't prove any of these fields are correct. The browser signs in through Yahoo's own page and never uses the client's stored host, port, or encryption values. The remaining field, the password, has its own rule, covered in the app password section below.

Which Yahoo IMAP Host to Use

Use imap.mail.yahoo.com for daily mail and export.imap.mail.yahoo.com only for one-way bulk download. The Yahoo help page that lists both hosts puts the ordinary incoming server on port 993 with SSL and names the export endpoint for mailbox downloads rather than ongoing sync.

Sync host versus export host

imap.mail.yahoo.com: Everyday mail, where read states, deletions, and folder moves must match everywhere.

export.imap.mail.yahoo.com: One-way downloading or exporting of mailbox data, such as a migration, backup, or archive script.

TLS requirement: Both jobs still need an encrypted session and a real authentication check before the account is treated as healthy.

A daily profile pointed at the export host fails in a misleading way. It can hang or refuse to sync like a firewall, DNS, or port fault while webmail still opens normally. Check the hostname before changing the network; it is the cheapest cause to rule out.

Password handling is the one place where the task changes the answer: the app password section below explains when Yahoo expects a generated password for a client, while bulk export cases can follow different sign-in guidance on Yahoo's download page. For setup, decide the host first, then compare the values with the mailX IMAP finder before testing login.

When Yahoo Mail Needs an App Password

The general rule is short. Yahoo requires a generated app password for third-party mail applications that don't use Yahoo's branded sign-in page. The Yahoo guide to third-party app access states that the app password is created in Yahoo Account Security and entered as the application's password. The normal account password can open Yahoo Mail on the web and still produce Authentication failed in Outlook, Thunderbird, Apple Mail, or custom IMAP code.

That's the counterintuitive part most setup guides skip. The web password isn't broken. Yahoo doesn't accept it from a client that signs in through its own password field rather than through Yahoo's page. Account Key and two-step verification follow the same pattern, since those features disable older sign-in methods that a basic password prompt depends on.

How to generate an app password

Open Yahoo Account Security in a browser while signed in to the account.

Find External connections and choose Create app password.

Name the application so the entry is recognizable later, for example by device or client.

Generate the code and copy it exactly as shown.

Paste the code into the client's password field once, replacing whatever secret was stored there.

How long an app password stays valid

Yahoo states the code is used once when signing in to the third-party app and remains active even if the main Yahoo account password changes. That surprises admins who rotate the account password expecting every client to drop offline. It won't happen. Revoking access requires deleting that specific app password from Account Security.

The reverse also holds. Generating a fresh app password doesn't update a client automatically. A phone or desktop app still holding the old code keeps sending the old code until someone pastes the new one in. Repeatedly retrying the normal Yahoo password after that point only repeats the same authentication failure, because the secret type is wrong, not just the secret value.

No specific date needs to be memorized for when Yahoo tightened this requirement. The current pattern is what matters for a setup happening today, and Yahoo's third-party access page remains the place to confirm it before a rollout. With a fresh app password in hand, client setup becomes a short, mechanical sequence.

How to Add Yahoo Mail in a Client

Manual setup beats automatic detection for Yahoo accounts. Auto-discovery sometimes guesses a server or leaves encryption on a default that doesn't match the port, and the error it returns rarely says which field it guessed wrong. One numbered path works across clients, with only button labels changing between them.

The manual setup sequence

Add the account, then choose manual or advanced setup rather than letting the app detect settings.

Set the account type to IMAP so folders and read states stay synchronized across devices; POP pulls mail down to a single client.

Enter the incoming server as imap.mail.yahoo.com, port 993, encryption SSL/TLS. Yahoo's export host is a separate endpoint meant for backups, so a daily client belongs on this sync host.

Enter the outgoing server as smtp.mail.yahoo.com, choosing one pair only: port 465 with SSL/TLS, or port 587 with STARTTLS.

Set the username on both servers to the full Yahoo email address, including the domain.

Paste a newly generated app password into the password field. The web sign-in password is the wrong secret type for IMAP, even when typed perfectly.

Save, let the folder list load, then send a message to the same address to prove SMTP works.

The two checks in step 7 are separate proofs. A folder list loading means IMAP authenticated, and a message arriving from the same account means SMTP authenticated on the chosen port pair. Skipping the send test leaves half the setup unverified until the first real message fails.

Where client interfaces differ

Three interface differences account for most confusion, and none of them change the values:

Microsoft Outlook: Ports hide behind Let me set up my account manually, so the manual path must be chosen before any server field appears.

Mozilla Thunderbird: Encryption modes are named SSL/TLS and STARTTLS directly, matching the terminology used above.

Apple Mail and mobile clients: An SSL switch appears instead of a mode menu, and that switch must be on for port 993.

Readers setting up a phone for the first time may find it useful to configure email on your iPhone following a general walkthrough, then apply the Yahoo values from the sequence above in place of any generic examples. The screens are similar across providers; the Yahoo host, port, and app password details are what stay specific.

Verification after setup is the live connection test covered in the verification section, and it separates a TLS problem from a credential problem.

Folder mapping almost never needs attention on a Yahoo account. Once the client authenticates over IMAP, it reads the folder list Yahoo returns and assigns Sent, Drafts, and Trash to the matching Yahoo folders on its own. Leave that default alone unless a custom application expects a specific mailbox name, because every mapping changed during initial setup adds a variable that makes later troubleshooting harder.

Why Yahoo IMAP Authentication Fails

Correct visible settings can still produce a failed login. That's the pattern that makes Yahoo IMAP troubleshooting frustrating, because the account screen shows the right host and port while the server keeps rejecting the session. The Yahoo guide to fixing IMAP problems explains that apps using outdated sign-in protocols may receive "Authentication failed" or "Server password has changed" because those protocols are disabled by default, and that an app password may be required when Account Key or two-step verification is enabled.

What you see	Likely cause	What to change
Authentication failed	Web password used, or app password missing	Create an app password and paste it once
Server password has changed	Stale cached secret or old sign-in method	Delete the account in the client and add it again
TLS error or timeout on 993	Port 993 set without SSL	Set SSL/TLS on port 993
Send fails, folders sync	465 set to STARTTLS, or 587 set to implicit SSL	Use 465 with SSL or 587 with STARTTLS
Webmail works, IMAP does not	Username is only the part before @	Use the full Yahoo email address
Export or backup hangs in a daily client	export.imap.mail.yahoo.com used for sync	Use imap.mail.yahoo.com for ordinary mail

Reading the failure in order

The table works as a decision order, not just a list. A TLS error means the session never reached the password stage, so generating new credentials won't help until the port and encryption pair is fixed. An authentication failure after a clean connection means the opposite, since the server was reached and the secret was refused. Keeping those two apart prevents the common loop of changing passwords to fix a transport problem.

A live connection test reports those stages separately: whether the server accepted the connection, whether encryption negotiated, and whether the login itself passed.

Cached credentials deserve special attention. Yahoo advises deleting and re-adding the account because saved settings can contain hidden invalid characters or corrupted data. A client can therefore keep sending a bad secret even after the visible password field looks updated, and a clean re-add clears that stored state in one move.

The full check order runs like this. Confirm the hostname, port 993, and SSL mode. Confirm the full email address as username. Replace the secret with a newly generated app password. Delete and re-add the account if the client may be caching the old secret. Only after those steps should a network block on port 993 become the prime suspect, which makes it time to check IMAP server connectivity as a separate variable.

How to Verify the Yahoo Connection

Two live tests settle whether the setup works: one for incoming mail, one for outgoing. Run both after the client is configured, on a mailbox under the reader's control, and review how to choose the right IMAP encryption settings before changing any port.

How to verify it

Run the IMAP test with the mailX IMAP checker against imap.mail.yahoo.com, port 993, SSL, the full email address as username, and the app password. A pass shows connection, encryption, and authentication succeeding as three separate results. A failure splits into the same two cases the authentication section laid out: transport problems on one side, a refused secret on the other.

Run the SMTP test on smtp.mail.yahoo.com, one pair at a time, either port 465 with SSL or port 587 with STARTTLS. A pass is a successful login on the chosen pair.

Match each failed result to the field it tests. A refused login sends the reader back to the app password, while a timeout or encryption error sends them to the hostname, port, and SSL pair. Once both tests pass on the exact credentials the client was given, the server settings are confirmed. Any remaining failure then sits inside the client itself, where deleting and re-adding the account clears cached values that a password field alone cannot reach.

Frequently Asked Questions About Yahoo IMAP Settings

Does Yahoo IMAP still use port 993 in 2026?

Yes. Yahoo's settings page lists imap.mail.yahoo.com on port 993 with SSL, using the full email address as the username. Yahoo can update its help documentation without changing the mailbox itself, so confirm the current values there before a large rollout.

Can the Yahoo account password be used in Outlook or Thunderbird?

Usually not. Clients that don't use Yahoo's branded sign-in page reject the account password and need an app password instead, as covered in When Yahoo Mail Needs an App Password. Paste the generated code into the client's password field once, in place of the normal password.

Does changing the Yahoo password update the mail app?

No. The mail app keeps syncing because the app password stays active until it's deleted in Account Security. To cut off a client, delete its app password there, then generate a new one for any client that should keep working.

Is there a different IMAP server for another country or a partner-managed mailbox?

Yahoo Mail uses the same public host, imap.mail.yahoo.com, in every country, so a regional hostname shouldn't be guessed. Partner-managed mailboxes are the exception covered in Which Yahoo IMAP Host to Use: get the server from Yahoo's own help pages or the mailbox administrator, then test that host with an IMAP connection check before deployment.

Copy the Yahoo values into the client, generate the app password, then prove the login before anyone depends on that mailbox. mailX runs live IMAP and SMTP connection tests that report connection, encryption, and authentication separately, free with no signup on the web, and through MCP for work inside AI tools.