Introduction

If Zoho Mail stops authenticating over IMAP right after you enable MFA, the problem is usually not the mailbox itself. It is usually one of four things: the client is still using the normal account password, IMAP is disabled, the wrong regional server name is configured, or the old credential is cached locally.

This is not a DNS cutover issue and it is not a generic mail delivery problem. Webmail can work perfectly while IMAP still fails. Treat it as a client authentication and mailbox access issue.

Symptoms

  • Outlook, Thunderbird, Apple Mail, or a mobile mail app starts showing repeated password prompts
  • The client reports authentication failed, invalid credentials, or login rejected
  • Zoho webmail works, but IMAP setup fails
  • A newly generated app password is rejected immediately
  • Incoming mail over IMAP fails, and sometimes SMTP send fails at the same time
  • The issue starts right after MFA was enabled or the main account password was changed

Common Causes

  • The mail client is still using the normal mailbox password instead of an app password
  • IMAP access is disabled for the mailbox in Zoho Mail settings
  • The wrong Zoho data center hostname is configured, such as using .com settings for an EU-hosted account
  • The client or operating system is reusing an old saved credential
  • The app password was revoked, replaced, or generated for the wrong account
  • Zoho security controls temporarily blocked the sign-in attempt
  • IMAP is configured correctly, but SMTP is still using the old password, causing the whole account setup to look broken

Step-by-Step Fix

  1. Confirm the mailbox itself is healthy by signing in to Zoho Mail in a browser with the same account and completing MFA successfully, because if webmail login fails, you need to fix account access before troubleshooting IMAP.
  2. Verify IMAP is enabled for the mailbox in Zoho Mail settings, because no app password will work over IMAP if the mailbox is not allowed to use IMAP access in the first place.
  3. Generate a fresh app password in the Zoho account security page and stop reusing old ones, because old client-specific passwords may have been revoked, replaced, or tied to a different device than the one you are testing.
  4. Use the correct Zoho server names for the account’s region, because an account hosted in the wrong data center endpoint can reject authentication even when the username and app password are correct.
  5. Remove cached Zoho credentials from the mail client and the operating system credential store before testing again, because many clients silently retry the stale password and make it look like the new app password is failing.
  6. Re-enter the account with the full email address as the username and the freshly generated app password exactly as issued, because using the main password or a shortened username is a common cause of repeated IMAP auth failures.
  7. Fix SMTP authentication at the same time and update outbound mail to use the same mailbox identity and fresh app password, because mismatched incoming and outgoing settings often keep triggering login prompts even after IMAP is corrected.
  8. Check Zoho account security activity for blocked or suspicious sign-in attempts and clear any security block before retrying, because a security hold can look identical to a bad password from the client side.
  9. Test the same mailbox in a second clean mail client or a new mail profile if the fresh app password still fails, because that quickly tells you whether the problem is client corruption or a mailbox-level authentication issue that needs Zoho support.