Connect your T-Online mailbox
to Claude, Cursor, any MCP client

This is the single most common T-Online connection failure and it produces an ordinary authentication error with nothing in it to tell you why. Telekom splits the account into a login password for telekom.de and the Kundencenter, and a separate Passwort für E-Mail-Programme for IMAP, POP3 and SMTP. The mail server accepts only the second one. Telekom explicitly advises that the two should differ, so even setting them to the same string is not the intended fix; create the mail-program password, then use it in both the incoming and the outgoing side of the connection.

The capability banner Telekom returns is IMAP4 IMAP4rev1 QUOTA LITERAL+ NAMESPACE UIDPLUS IDLE SORT. There is no AUTH=PLAIN, no AUTH=LOGIN and no SASL-IR in it. In practice the server expects the plain IMAP LOGIN command rather than a SASL AUTHENTICATE exchange. Client libraries that enumerate advertised SASL mechanisms and refuse to proceed when the list is empty give up before they ever send credentials, which is why some IMAP tooling reports T-Online as unreachable while Thunderbird connects to the same mailbox without complaint. MCPEmails handles the bare LOGIN path, so this one is already dealt with for you.

The server does not advertise the IMAP MOVE extension, so filing a message is performed as a copy, a flag update and an expunge rather than one atomic command. It also omits SPECIAL-USE, which means Sent, Drafts, Trash and Junk are identified by name and not by role. A T-Online mailbox normally names them Gesendet, Entwürfe, Papierkorb and Spam, so if an agent cannot find your archive or sent folder, name it in the instruction.

securesmtp.t-online.de announces a maximum message size of 52,428,800 bytes. That is the size of the whole encoded message, so base64 attachments count roughly a third larger than their size on disk. An agent asked to forward a large attachment will get a hard SMTP rejection rather than a slow send.

Telekom checks the internet connection a message is sent from. Its help says that when a mail program sends from an unknown or unapproved IP address, the message is not sent and the program gets an error, and it names another Wi-Fi network, a mobile network, a VPN or a connection abroad as common causes. Mail your agent sends through MCPEmails leaves from MCPEmails' servers, not from your home connection, so it can be held the same way. Telekom says you can approve (freischalten) the IP address if the attempt was yours. If it was not, do not approve it, and change your Telekom Login password.

• Because the server has no MOVE support, a move is not atomic. If a connection drops mid-operation a message can briefly exist in both folders.
• Telekom scopes the mail-program password to mail clients. It does not unlock the Kundencenter, and rotating your Telekom login password does not rotate it, so the two have to be maintained separately.