---
title: "Your addresses in any mail app"
description: "Read and send from an address in Apple Mail, Outlook, Thunderbird, the Gmail app or your phone’s own mail app, signed in with an app password."
url: "https://nextmail.sh/docs/knowledge/addresses/mail-apps"
area: "Knowledge base"
category: "Mail apps"
status: "live"
---

# Your addresses in any mail app

Read and send from an address in Apple Mail, Outlook, Thunderbird, the Gmail app or your phone’s own mail app, signed in with an app password.

## Details

- Every address that keeps its mail in Nextmail works in Apple Mail on a Mac, iPhone or iPad, in Outlook, Thunderbird and the Gmail app, and in any other app that adds a mail account by hand. The app signs in over IMAP, SMTP or POP3, encrypted with SSL/TLS on every port, with the address itself as the username.
- The password is an app password for that one address: 16 letters, shown once, created on the address’s Mail apps tab under Settings → Addresses or over the API. It acts as the person who created it, with what that person may do at the address, and each person can hold 20 per address. Revoking one signs its app out within about five minutes.
- The workspace owner, or anyone who manages members, can email somebody a one-time setup link instead. It works once within three days and shows a new app password with the settings and, for an iPhone, iPad or Mac, a profile that adds the account to Mail in one step.
- Nothing moves. The folders are the mailbox’s own folders and labels, read and starred state sync both ways, and because Nextmail files whole conversations, moving or deleting one message in the app moves or deletes its conversation. Mail sent from the app goes out through Nextmail with the same checks as the web app, and a copy lands in Sent.
- Gmail on the web no longer reads other accounts, so there the address is forwarded to Gmail and added under Send mail as. The Gmail app on a phone adds it as an account of its own.
- Calendar apps reach the calendar of the address over CalDAV with the same username and password. IMAP, POP3, SMTP, CalDAV and CardDAV can each be switched off for one address on its own.
- The same is on the REST API, the SDKs, the CLI and the MCP server. Creating an app password over MCP asks for confirmation and a verification code first, and the password then appears once, in the chat.
- Mail sent from an app carries the signature of the address and follows its open and click tracking settings, like mail sent in the web app. A signed or encrypted message and a calendar invitation go out exactly as the app wrote them.

## Server settings

Every mail app asks for the same few settings. Each connection is encrypted with SSL/TLS from the first byte, so choose SSL/TLS wherever the app offers a choice. Outgoing mail also works on port 587 with STARTTLS, for apps and devices that offer nothing else.

| Setting | Value |
| --- | --- |
| Incoming mail (IMAP) | `imap.openemail.uk`, port `993`, SSL/TLS |
| Outgoing mail (SMTP) | `smtp.openemail.uk`, port `465`, SSL/TLS |
| Incoming mail (POP3) | `pop.openemail.uk`, port `995`, SSL/TLS, only for an app that cannot use IMAP |
| Username | The whole address, such as `support@acme.com`, for incoming and outgoing mail alike |
| Password | An app password for that address, for incoming and outgoing mail alike |
| Sign-in method | Normal password. Leave Secure Password Authentication (SPA) and OAuth off. |
| Calendar (CalDAV) | `https://api.nextmail.sh/dav/`, for Apple Calendar, Thunderbird, DAVx5 and other calendar apps, with the same username and password |

> Choose IMAP when the app offers it. IMAP keeps folders, read state and stars the same in every app and in Nextmail, while POP3 only downloads the inbox.

## Set up your app

Each guide takes one app from start to finish: where every setting goes, what to change afterwards and what to do when it refuses.

- [Mail on iPhone and iPad](https://nextmail.sh/docs/knowledge/addresses/mail-apps/iphone-ipad.md): The profile in one step, or every field by hand, then mailboxes and fetching.
- [Mail on a Mac](https://nextmail.sh/docs/knowledge/addresses/mail-apps/mac.md): The profile or a manual account, with the server settings and mailbox behaviours to check.
- [Outlook](https://nextmail.sh/docs/knowledge/addresses/mail-apps/outlook.md): The new and classic Outlook for Windows, Outlook for Mac and the Outlook app on phones.
- [Thunderbird](https://nextmail.sh/docs/knowledge/addresses/mail-apps/thunderbird.md): Every field of the manual setup, and the folder settings that matter.
- [The Gmail app](https://nextmail.sh/docs/knowledge/addresses/mail-apps/gmail-app.md): An account of its own in the Gmail app on Android and iPhone.
- [Gmail on the web](https://nextmail.sh/docs/knowledge/addresses/mail-apps/gmail-web.md): Forward the address to Gmail and send from it with Send mail as.
- [Android mail apps](https://nextmail.sh/docs/knowledge/addresses/mail-apps/android.md): Samsung Email, Thunderbird for Android, K-9 Mail and the rest.
- [Calendars over CalDAV](https://nextmail.sh/docs/knowledge/addresses/mail-apps/calendars.md): Apple Calendar, Thunderbird and DAVx5, with invitations and what syncs.
- [Contacts over CardDAV](https://nextmail.sh/docs/knowledge/reading/contacts#contacts-apps): Put the contacts of the workspace into the contacts app of a phone or computer.
- [Folders, sync and sending](https://nextmail.sh/docs/knowledge/addresses/mail-apps/sync.md): How folders, read state, stars and deletions travel between an app and Nextmail.
- [Troubleshooting mail apps](https://nextmail.sh/docs/knowledge/addresses/mail-apps/troubleshooting.md): Every message a mail app can show, what it means and the fix.

## Any other mail app

Any app that adds a mail account by hand works. Look for its manual or advanced setup, then:

1. Choose IMAP as the account type, or POP3 only if the app offers nothing else.
2. Enter the incoming and outgoing servers from the table above, each with SSL/TLS, sometimes labelled SSL, on the port shown.
3. Use the whole address as the username and the app password as the password, for both servers.
4. Choose Normal password, or Password, as the sign-in method, and turn on sign-in for the outgoing server.

## App passwords

A mail app does not sign in with the password of your Nextmail account. It signs in with an app password, made for one address and shown once.

1. Open the address under Settings → Addresses, go to its Mail apps tab and choose Passwords.
2. Choose Create app password and name it after the app or device it is for, such as iPhone or work laptop. Nextmail asks for your verification code first.
3. Copy the password straight away. It is 16 letters in four groups of four, and it is shown only this once. Spaces, dashes and capitals make no difference when you type it.
4. Enter it in the mail app as the password for incoming and outgoing mail alike.

- An app password acts as the person who created it, for that one address, with what that person may do there. Reading needs permission to read the mail, moving and marking need permission to label and archive it, and sending needs permission to send from the address. When their role or their access to the address changes, a mail app that stays connected follows within about five minutes.
- Anyone who can read an address can create app passwords for it, up to 20 each. The workspace owner, and anyone whose role manages members, sees every app password on the address and can revoke any of them. Everyone else sees and revokes their own. The list shows who each one acts as and when a mail app last used it.
- Where a new password is shown, Download for Apple devices saves a profile that sets up an iPhone, iPad or Mac with it in one step.
- Rename a password from its row in the Passwords view, such as when its device changes hands. Whoever can revoke a password can rename it, and the app using it stays signed in.
- An address with a password sign-in of its own, set on its Access tab, can use that password in a mail app as well, but only while that sign-in has two-factor turned off. With two-factor on, the mail app is refused and needs an app password instead.
- In a workspace that requires two-factor, an app password works only while the person it belongs to has an authenticator app or a passkey, and the password of an address sign-in never opens a mail app there. API keys sending over SMTP are not affected.

## Send a setup link

When somebody else will use the mail app, email them a setup link instead of passing a password around.

1. On the address’s Mail apps tab, choose Passwords, then Email setup link. Enter their email address and choose Send link. Nextmail asks for your verification code first.
2. They get an email with the server settings and a button. It opens a page where Show my password creates a new app password and shows it once, with the settings, a link to these guides and Download for Apple devices, a profile that sets up Mail and Calendar on an iPhone, iPad or Mac.

- Only the workspace owner, or someone whose role manages members, can send one.
- The link works once and expires after three days. Opened again after that, it says it was used or has expired, and you send a new one.
- Opening the page does not use the link up. Only Show my password does, so a link scanner that opens it first changes nothing.
- Opening it needs no Nextmail account.
- The password it creates acts as you, the sender, for that one address. It appears among your app passwords on the tab, named after their email address, and you revoke it like any other.
- A password made through a setup link opens the mail and the calendar of the address, never its contacts.
- A workspace can email 50 setup links a day. Past that, create an app password and hand it over yourself.

## Turn protocols on or off

Each address has a switch for every way an app can reach it: IMAP, POP3 and SMTP for mail apps, CalDAV for calendar apps and CardDAV for contacts apps. All five start on.

1. Open the address under Settings → Addresses, go to its Mail apps tab and stay on Servers.
2. Turn off what the address should not offer, such as POP3 when every app uses IMAP, or SMTP for an address that should only be read in mail apps.

- Only the workspace owner, or someone whose role can change domains, can turn a protocol on or off.
- A protocol switched off refuses new sign-ins at once, with a message saying that kind of connection is turned off for the address. Apps already connected over it are signed out within about five minutes.
- App passwords stay as they are, so switching a protocol back on lets the same apps in again.
- The switches only concern apps that sign in with an app password or the address’s own password. The address keeps sending and receiving in Nextmail, and the API and the web and mobile apps are not affected.
- The profile for Apple devices leaves out what is switched off.

## Revoking access

- Revoke an app password on the address’s Mail apps tab, or over the API. A mail app that stays connected with it is signed out within about five minutes, and one that connects again is refused straight away. The address and its mail stay as they are.
- Taking away someone’s access to the address, or changing their role, reaches their app passwords the same way. So does switching the address off or setting it to only forward.
- Removing the address’s own password sign-in, or turning on two-factor for it, signs out the mail apps that used that password the same way.

## From code, the terminal and agents

Everything on the Mail apps tab is in the REST API under `/domains/{id}/addresses/{addressId}`, in the SDKs and the CLI under `domains`, and in the MCP tools.

- `GET /domains/{id}/addresses/{addressId}/mail-apps` reads the server settings and, in `protocols`, which protocols are on. It needs `domains:read`. `PATCH` on the same path turns protocols on or off with the booleans `imap`, `pop3`, `smtp`, `caldav` and `carddav`, and needs `domains:write`.
- `GET` and `POST /domains/{id}/addresses/{addressId}/app-passwords` list and create app passwords, `PATCH /domains/{id}/addresses/{addressId}/app-passwords/{passwordId}` renames one with `name`, `DELETE` on the same path revokes one, and `POST /domains/{id}/addresses/{addressId}/mail-app-setup` emails a setup link. They need `members:write`, and a key limited to some addresses or domains cannot use them. Creating an app password or emailing a setup link hands the address to a mail app, so the key must itself hold every scope the password would carry: `threads:read`, `threads:write`, `emails:send`, `drafts:write`, `labels:write`, `calendar:read`, `calendar:write`, `contacts:read` and `contacts:write`. An app must hold those of them that the role of the person who connected it holds. Without one of them the answer is 403 `insufficient_authority`.
- A new app password comes back once, in the response that creates it, with `appleProfile`, the profile for iPhone, iPad and Mac as `.mobileconfig` XML. One created with an API key acts as the workspace owner, and one created by a connected app acts as the person who connected it.
- An OAuth access token is asked for a verification code before it creates an app password or emails a setup link. An API key is never asked.
- In the SDKs, `domains.updateMailAppSettings` changes the switches and `domains.updateAppPassword` renames a password, in TypeScript, PHP and Java alike, and `update_mail_app_settings` and `update_app_password` do the same in Python and Ruby. Go and C# name them `UpdateMailAppSettings` and `UpdateAppPassword`, with an `Async` suffix in C#. The CLI runs them as `nextmail domains update-mail-app-settings` and `nextmail domains update-app-password`.
- The MCP tools read the settings, switch protocols with `updateMailAppSettings`, list, rename and revoke app passwords with `listAppPasswords`, `renameAppPassword` and `revokeAppPassword`, and email setup links with `sendMailAppSetup`. `createAppPassword` asks for confirmation and a verification code first, and the password appears once, in the chat.

- [REST API](https://nextmail.sh/docs/api/reference/domains.md): Every domains operation, the mail app ones included, with what each takes and returns.
- [TypeScript SDK](https://nextmail.sh/docs/sdk/reference/domains.md): The methods of `nextmail.domains`, from `getMailAppSettings` to `sendMailAppSetup`.
- [Python SDK](https://nextmail.sh/docs/python/reference/domains.md): The methods of `client.domains` in Python.
- [Ruby SDK](https://nextmail.sh/docs/ruby/reference/domains.md): The methods of `client.domains` in Ruby.
- [PHP SDK](https://nextmail.sh/docs/php/reference/domains.md): The methods of `$client->domains` in PHP.
- [CLI](https://nextmail.sh/docs/cli/reference/domains.md): The `nextmail domains` commands.
- [MCP tools](https://nextmail.sh/docs/mcp/tools/domains.md): The domain tools, the seven mail app tools among them.