Issue Losing connection to emails with Outlook Client, problem with DIGEST-MD5

[Net Fisher]

We have a Plesk setup that holds an email server with around 100 accounts. Everything is working fine except for one thing:

Sometimes, our Outlook Clients crash all at the same time, while asking users to enter their email and password and rejecting them to login.

This shows up the following error in /var/log/maillog:

mail.example.com postfix/smtpd[17318]: warning: SASL authentication failure: realm changed: authentication aborted

The issue is exactly stated here: Outlook fails to send an email: SASL authentication failure.

This issue happens from 0 to 3 times a week, but its becoming a problem for our users because the email stops working untill SMTP service is restarted.

We already applied the fix from the previous Help Center link, but after we change:

from:

"mech_list: DIGEST-MD5 CRAM-MD5 PLAIN LOGIN"

to:

"mech_list: CRAM-MD5 PLAIN LOGIN"

And restart the Postfix service, it results in users autenthication still showing as DIGEST-MD5.

Since this Postfix configuration change seems to not have any effect, we also changed "auth_mechanisms" in Dovecot configuration file file: /etc/dovecot/dovecot.conf

From:

"auth_mechanisms = plain login digest-md5 cram-md5 apop"

To:

"auth_mechanisms = plain login cram-md5 apop"

Which results in users autenthicating in PLAIN LOGIN and not CRAM-MD5.

1) If DIGEST-MD5 is not supported by Outlook Client as Plesk states, then why our email works with it for days untill it crashes? is it still not supported?

2) Is Outlook Client not supporting CRAM-MD5 and thats why our Postfix/Dovecot fixes are resulting into a PLAIN LOGIN autenthication?

We need to fix these crashes, but we are not willing to pay the PLAIN LOGIN authentication price, we would really like to switch to CRAM-MD5

 

[Nicola Urbinati]

Try to change the "auth_mechanisms = plain login cram-md5 apop" setting for dovecot (I solve it there).
Be careful: sometimes the setting gets restored, so you'll have to change it again.

 

[Net Fisher]

Try to change the "auth_mechanisms = plain login cram-md5 apop" setting for dovecot (I solve it there).
Be careful: sometimes the setting gets restored, so you'll have to change it again.

Hello Nicola,

I did also made that change for the Dovecot config file, but then the users are autenthicating as PLAIN LOGIN. Seems like no matter how I set it up, they either autenthicate as DIGEST-MD5 or PLAIN-LOGIN, but never with CRAM-MD5.

Is it that Outlook Client 2016 is not compatible with CRAM-MD5, or that any configuration has to be done on the Outlook Clients to force using CRAM-MD5? I've been reading around but found nothing about it

 

[Nicola Urbinati]

I think it's Outlook-related, do not know enough about it to help you more, I solve by adjusting dovecot by my side.