“IMAP server issued an unrecognized greeting”

When setting up or synchronizing an email account inside a desktop client (such as Microsoft Outlook, Mozilla Thunderbird, or Apple Mail), the connection handshake may fail with the error:

The IMAP server issued an unrecognized greeting.
Protocol: IMAP
Server: mail.yourdomain.com (or imap.gmail.com)
Error Code: 0x800CCCD9 / 0x800CCC0F

This error means the email client opened a network connection to the server, but the very first line of text it received back was unexpected or unreadable.

Quick Answer

The “unrecognized greeting” error happens when an email client connects to an incorrect port (such as sending plain text to an SSL-encrypted port), or when a security device (like a captive portal or firewall) intercepts the connection and returns an HTML error page instead of an IMAP banner. To fix it, verify that your IMAP port matches your security type (Port 993 with SSL/TLS) and disable active VPNs or security proxies.

---

What the Error Means

Under the Internet Message Access Protocol (RFC 3501), every IMAP conversation must start with an explicit greeting banner from the server as soon as the TCP connection opens:

* OK [CAPABILITY IMAP4rev1 SASL-IR ...] Server Ready

The * OK prefix is the greeting that tells the email client: “This is a standard IMAP server ready to process your commands.”

If the client connects and receives anything else—such as an empty line, an HTML error page (<html><body>Error...), an SSH banner, or an encrypted binary handshake before it expected one—it aborts the connection and reports that the server issued an “unrecognized greeting.”

---

Technical Causes

"Unrecognized Greeting" Detected
│
├── Did you recently update port or SSL/TLS settings?
│   ├── YES ──► Protocol/Port mismatch (e.g., plaintext on Port 993).
│   └── NO  ──► External interception or IP filtering.
│
├── Are you on public Wi-Fi or behind an office firewall?
│   ├── YES ──► Captive portal or security gateway returning HTML splash page.
│   └── NO  ──► Local security software / proxy breaking the socket handshake.

1. Connecting in Plain Text to an SSL Port: If your client is set to use Port 993 but has SSL/TLS turned off, it expects a plain text greeting. Instead, the server sends a binary TLS handshake packet. The client cannot read the raw binary data, so it flags the greeting as unrecognized.
2. Wi-Fi Captive Portal Interception: When you connect to public Wi-Fi (such as in a hotel or airport) without signing in, the network intercepts all outgoing traffic. When Outlook asks for an IMAP handshake, the network gateway returns an HTTP redirect or HTML sign-in page instead of an OK response.
3. Firewall or Antivirus SSL Inspection: Security utilities that scan encrypted email often intercept port 993. If the security tool’s local proxy server fails or presents an invalid internal certificate, it passes a malformed greeting back to your mail client.
4. Incorrect Server Hostname: Entering the hostname of a web server or secondary service instead of the dedicated mail host (e.g., www.domain.com instead of imap.domain.com) routes your client to a service that does not speak the IMAP protocol.

---

Progressive Diagnostic Steps

Step 1: Align Port and Encryption Protocol

Ensure your incoming mail settings follow standard configuration pairings:

• Standard Encrypted (Recommended):
  • Server: imap.gmail.com (or your provider’s IMAP host)
  • Port: 993
  • Encryption: SSL/TLS (Implicit)
• Alternative / Explicit TLS:
  • Port: 143
  • Encryption: STARTTLS

If your configuration pairs Port 993 with None or STARTTLS, the client will misinterpret the incoming data and throw the unrecognized greeting error.

---

Step 2: Read the Raw Server Greeting via Command Line

You can see exactly what text the server is returning by using PowerShell or Terminal to test the connection directly:

On Windows (PowerShell):

# Test plaintext/STARTTLS greeting on Port 143:
tnc mail.yourdomain.com -port 143

On macOS or Linux (Terminal):

# Connect and read the initial banner on Port 143:
nc -v mail.yourdomain.com 143

Using OpenSSL to test Port 993:

openssl s_client -connect imap.gmail.com:993 -crlf

Look at the very first line of the output:

• If it starts with OK, the server is working normally. The issue lies within your email client’s local settings or an active add-in.
• If it returns HTML tags (<!DOCTYPE html>), your network connection is being intercepted by a captive portal, proxy, or firewall.
• If it returns Connection refused, the port is completely blocked by your ISP or local network router.

---

Step 3: Disable Email Scanning in Local Antivirus Software

If security software intercepts your mail traffic locally, it can corrupt the incoming protocol greeting:

1. Open your third-party antivirus software (e.g., Avast, AVG, Bitdefender, or ESET).
2. Go to Settings > Protection > Mail Shield (or Email Protection).
3. Temporarily turn off the option to scan incoming IMAP connections.
4. Return to your email client and click Send/Receive.

If the error clears, install the antivirus program’s internal root certificate into your system’s certificate store, or keep direct IMAP scanning turned off and rely on real-time file system protection instead.