MozillaZine

Yahoo

From MozillaZine Knowledge Base

This article was written for Thunderbird but also applies to Mozilla Suite / SeaMonkey (though some menu sequences may differ).

Yahoo! provides a free POP and SMTP server if you have a webmail account. This used to require you to have a webmail account in a non-USA yahoo domain (for example de.yahoo.com). A common workaround to get POP support if you lived in the USA was to change "Regional Site and Language" in Yahoo Webmail's account settings to Yahoo Asia, and then enable POP access in the POP & Forwarding section in Webmail options (you would still keep your existing email address and it doesn't change what language you use). However, that restriction has been removed and all of the features that used to be part of Yahoo’s Mail Plus product (disposable email addresses, POP email and mail forwarding) are now free. They have also increased the storage limit to 1TB.

Yahoo also has a free IMAP and SMTP server that officially only supports smartphones and Zimbra email clients. However, the Thunderbird account wizard supports creating a Yahoo IMAP account using the "Yahoo for Mobile" IMAP settings.

Before you add an account in Thunderbird:

If you don't do this you may get a "#MBR1212 Incorrect username or password" error or a "sending of password for user XYZ did not succeed" error when Thunderbird tries to log into the mail server. The exact wording of the error message has changed several times. [1]. Ways to securely access Yahoo Mail doesn't describe how Yahoo determines that a email client is insecure and/or obsolete, or what the "current security standards" are.

Create a new account by pressing the Add Mail Account button in Tools -> Account Settings -> Account Actions. It will default to creating a POP account. If you want an IMAP account select the IMAP radio button. If your ISP provides you a Yahoo account it may use mail servers with a different domain and use the full email address as the username. Otherwise configure it as follows (if you're not relying upon the account wizard to do this for you):

Contents

POP

  • Type: POP
  • Server Name: pop.mail.yahoo.com or plus.pop.mail.yahoo.com if you are using Yahoo! Mail Plus
  • User Name: Just the portion of the email address to the left of the '@'
  • Port: 995
  • Secure connection: SSL/TLS
  • Secure authentication: normal password

You used to be able to use the mail server for your domain (such as pop.mail.yahoo.de) but that broke. A email address in a different domain will still work using pop.mail.yahoo.com.

SMTP

  • Server Name: smtp.mail.yahoo.com
  • User Name: Just the portion of the email address to the left of the '@'
  • Port: 465
  • Secure connection: SSL/TLS
  • Secure authentication: normal password

Its also possible to use port 587 with secure connection set to none.

IMAP

  • Type: IMAP
  • Server Name: imap.mail.yahoo.com
Use imap.mail.att.net if that doesn't work. Its not clear yet if the official mail server is going to change. [2]
  • User Name: Just the portion of the email address to the left of the '@'
  • Port: 993
  • Secure connection: SSL/TLS
  • Secure authentication: normal password

If you are using an old version of Thunderbird and want an IMAP account you need to press the Manual Config button while creating the account so that you can select IMAP and change the mail server. In recent versions all you need to do is select the IMAP radio button.

IMAP works differently

IMAP accounts let you access all of the webmail folders. It treats folders on the mail server (remote folders) as if they were local folders, so that you can copy/move messages to/from them.

It has a client-server view of the world rather than a download-centric one. While you can use the folders as if they are local folders it actually only downloads the headers (not the messages) to the mail folder on the hard disk. That means whenever you open a message it fetches it again from the mail server, so its a poor choice if you have a slow Internet connection. Thunderbird 3.0 added support for offline copies of the folders. This is enabled by default in Tools -> Account Settings -> Yahoo -> Synchronization & Storage. They are a useful way to backup the folders or to read messages when working offline but they're ignored when you're working online. There is also a optional IMAP cache but it mainly just caches remote images, not messages.

IMAP accounts support hiding folders you don't want to see by not subscribing them. Thunderbird may automatically subscribe the inbox, sent, and bulk mail folders when it creates the Yahoo IMAP account. It will also automatically subscribe any new folder you create using Thunderbird. You can right click on the account name in the folder pane, select subscribe, and then choose from the list which folders to display. If you don't like the idea of using subscription to manage what folders you see, uncheck Tools -> Account Settings -> Yahoo -> Server Settings -> Advanced -> "Show only subscribed folders".

UID Fetch Server error

This error can occur with Yahoo IMAP accounts. It seems to mainly occur when there is a problem fetching the contents of a message in the Spam, Bulk Mail or Trash folder. Deleting the folders contents, emptying the trash, and compacting the folders works around the problem. [3]

The POP3 email server (plus.pop.mail.yahoo.com) does not support UIDL or XTND or XLST

The Yahoo POP server seems to have periodic problems where it returns a "The POP3 email server (plus.pop.mail.yahoo.com) does not support UIDL or XTND or XLST, which are required to implement the "Leave on Server," "Maximum Message Size," or "Fetch Headers Only" options. To download your mail, turn off these options in the Server Settings for your mail server in the account settings window." error message. This problem occurs with both plus.pop.mail.yahoo.com and pop.mail.yahoo.com.

When this occurs you can't download new messages. Sometimes this can be worked around by exiting and restarting Thunderbird. Other times you need to wait until Yahoo fixes the problem with the server (usually takes only a day). [4] [5]

Don't uncheck the "leave messages on server" checkbox as that will download all of the messages on the server (old and new) and delete the messages stored on the mail server. [6]

[CLIENTBUG] SELECT command is not valid in this state

Edit Tools -> Account Settings -> Yahoo -> Server settings -> Username to delete the domain name (@yahoo.com.xx....) from the email address. Yahoo wants just the portion of the email address to the left of the '@' as the username.

The problem can also occur if you don't enable "allow insecure apps" in the yahoo webmail settings.

bug report

Can not subscribe folders

Check if Tools -> Account Settings -> Server Settings -> Advanced -> "IMAP Server directory" is set to [Gmail]. That will prevent Thunderbird from discovering your remote folders, even if "allow server to override these namespaces" is also checked. Delete [Gmail] and press the OK button.

Two factor authentication

Yahoo Account Key is a optional two factor authentication that disables using your password and requires you to enter an "account key" that is sent to an app on your smartphone. Thunderbird doesn't support that. However, you can create a 3rd party app password to use with Thunderbird, to work around that. You would need to delete your old password in Thunderbird, exit and restart to use that new password. If Yahoo Account Key is accidentally enabled and you want to disable it, see You want to turn off Account key and/or How to Deal with Access Key Log-In to Yahoo! Mail

OAuth2 authentication

Yahoo is starting to display warnings for some users that are using a ISP that uses Yahoo for email such as Frontier, telling them they should use OAuth2:

Access your mail via frontier.yahoo.com or with a mail client that supports OAuth
Upgrade your current mail client to a version that supports OAuth
Visit https://security.frontier.com/ and create an app-specific password

The developers haven't been able to find a contact in the Yahoo mail team to discuss adding OAuth support in Thunderbird accounts. This problem is not limited to Thunderbird/SeaMonkey. If you run into this problem an interim workaround might be to generate a app-specific password for Thunderbird and use it instead of the normal password. [7]

Security news

"A big part of the problem that Ottenheimer and Avivah Litan, vice president and analyst at Gartner Research, describe is that Yahoo simply isn’t willing to invest in security."

"Forged cookies could allow an intruder to access users' accounts without a password. Based on an ongoing Yahoo investigation, we believe an unauthorised third party accessed our proprietary code to learn how to forge cookies."

"Stolen user account information may have included names, email addresses, phone numbers, dates of birth, "hashed" passwords and, in some cases, encrypted or unencrypted security questions and answers" [8]

"Yahoo last year secretly built a custom software program to search all of its customers’ incoming emails for specific information at the request of US intelligence officials, according to a report". "When Stamos found out that Mayer had authorized the program, he resigned as chief information security officer and told his subordinates that he had been left out of a decision that hurt users’ security, sources said. Due to a programming flaw, he told them, hackers could have accessed the stored emails."

“Yahoobleed” flaw leaked private e-mail attachments and credentials discusses security bugs caused by not installing patches.

See also

External links

Temporary problems (fixed) with Yahoo mail server:

Yahoo settings: