Chapter 11 Clients, Groupware & CLI Admin: #pUsers

Set up Outlook for Windows: mail via IMAP, calendar & contacts via CalDav Synchronizer

Microsoft Outlook for Windows connects to nextxch via IMAP (incoming) and SMTP (outgoing). This applies to classic Outlook (Microsoft 365 Apps, Outlook 2016 to 2024) and to the new Outlook for Windows. In classic Outlook, the free open-source add-in CalDav Synchronizer additionally syncs calendars, contacts and tasks via CalDAV and CardDAV. This page lists the exact server settings and explains plainly why the "Exchange" account type does not work in Outlook for Windows.

Operational Tip & Architecture Note

The username is always the full email address. If two-factor sign-in (2FA) is enabled for the account, IMAP, SMTP and CalDAV/CardDAV reject the normal password: in Webmail, open Settings -> 2FA, Passkeys & Password -> Device & App Passwords, create a dedicated App Password for Outlook and enter it wherever Outlook or CalDav Synchronizer asks for a password. When a laptop is retired, you revoke only that one App Password.

Server settings for Outlook (classic and new Outlook)

The hostname is the server name of your nextxch installation, for example mail.company.com. For mailboxes hosted on mail.nextxch.com, enter mail.nextxch.com.

Reference / Configuration

Account type:           IMAP   (not "Exchange", not "Exchange 2013 or earlier")
Email address:          anna.weber@company.com
User name:              anna.weber@company.com   (always the full address)
Password:               account password, App Password if 2FA is enabled

Incoming (IMAP):        mail.company.com   Port 993   Encryption: SSL/TLS
Outgoing (SMTP):        mail.company.com   Port 465   Encryption: SSL/TLS
  or alternatively:     mail.company.com   Port 587   Encryption: STARTTLS
SMTP authentication:    required, same credentials as incoming
Secure Password Authentication (SPA): off

Hosted mailboxes:       mail.nextxch.com instead of mail.company.com

1. Classic Outlook: set up an IMAP account

If autodiscover.<your-domain> points to the server, Outlook often proposes the IMAP settings itself, because nextxch answers Autodiscover with the IMAP and SMTP settings. Otherwise, set up the account manually in a few steps.

Reference / Configuration

1. File -> Add Account -> enter the email address
2. Expand "Advanced options" -> "Let me set up my account manually" -> Connect
3. Choose account type "IMAP"
4. Incoming mail:  server mail.company.com · port 993 · encryption SSL/TLS
   Outgoing mail:  server mail.company.com · port 465 · encryption SSL/TLS
                   (or port 587 · encryption STARTTLS)
   Do NOT enable "Require logon using Secure Password Authentication (SPA)"
5. Enter the password or App Password -> Connect -> Done

Change later: File -> Account Settings -> Account Settings -> select account -> Repair / Change

2. New Outlook for Windows: add an IMAP account

Important for data sovereignty: according to Microsoft, the new Outlook syncs accounts of other providers through the Microsoft Cloud. Credentials and a copy of the mailbox content are processed on Microsoft servers. If you want to avoid that, use classic Outlook, Thunderbird or the nextxch Webmail.

Reference / Configuration

1. Settings (gear) -> Accounts -> Email accounts -> Add account
2. Enter the email address -> Continue
3. Choose "IMAP" as the provider and show the advanced settings
4. IMAP incoming server:  mail.company.com · port 993 · SSL/TLS
   SMTP outgoing server:  mail.company.com · port 465 · SSL/TLS (or 587 · STARTTLS)
   User name:             full email address (for IMAP and SMTP)
   Password:              account password or App Password (with 2FA)
5. Continue -> confirm sync with the Microsoft Cloud -> Done

Calendar and contacts: not available for IMAP accounts in the new Outlook

3. Calendar, contacts & tasks in classic Outlook with CalDav Synchronizer

CalDav Synchronizer is a free open-source add-in (AGPL) for classic Outlook for Windows, available at caldavsynchronizer.org. It is an independent project; nextxch is not affiliated with it. Create one sync profile each for calendar, contacts and tasks.

Reference / Configuration

1. Install CalDav Synchronizer and restart Outlook
2. Ribbon "CalDav Synchronizer" -> "Synchronization Profiles" -> "+" (add profile)
3. Choose profile type "Generic CalDAV/CardDAV"
4. Select the Outlook folder, e.g. "Calendar (This computer only)" of the IMAP account
   or a new, empty folder
5. Enter the DAV URL:
     Calendar:  https://mail.company.com/dav/calendars/anna.weber@company.com/default/
     Contacts:  https://mail.company.com/dav/addressbooks/anna.weber@company.com/default/
     Tasks:     https://mail.company.com/dav/calendars/anna.weber@company.com/tasks/
   Discovery: https://mail.company.com/.well-known/caldav
              https://mail.company.com/.well-known/carddav
6. Username:      anna.weber@company.com
   Password:      account password or App Password (with 2FA)
   Email address: anna.weber@company.com
7. "Test or discover settings" -> confirm connection and resource
8. Synchronization mode: "Outlook <-> Server (Two-Way)" · interval e.g. 5 minutes
9. Save with OK; repeat steps 2 to 8 for contacts and tasks

4. Why the "Exchange" option does not work in Outlook for Windows

Outlook for Windows connects Exchange-type accounts via MAPI over HTTP, a proprietary Microsoft protocol that nextxch does not implement. Outlook for Windows does not use Exchange ActiveSync, which nextxch supports, for your own servers. The new Outlook for Windows supports Exchange accounts only through Microsoft services and not with servers of other vendors. So when setup as an Exchange account fails, nothing is wrong with the server: for Outlook for Windows, IMAP plus CalDav Synchronizer is the intended path. All other common clients fully sync mail, calendars and contacts, as the overview shows.

Reference / Configuration

Client                              Mail                    Calendar, contacts & tasks
----------------------------------  ----------------------  ---------------------------------------
Outlook for Windows (classic)       IMAP + SMTP             CalDav Synchronizer (CalDAV/CardDAV)
Outlook for Windows (new)           IMAP + SMTP             not available, use Webmail
Outlook for iOS and Android         Exchange ActiveSync     Exchange ActiveSync
iPhone and iPad                     ActiveSync or IMAP      ActiveSync or CalDAV/CardDAV
Android (Gmail, Samsung, DAVx5)     ActiveSync or IMAP      ActiveSync or CalDAV/CardDAV (DAVx5)
macOS (Mail, Calendar, Contacts)    IMAP + SMTP             CalDAV/CardDAV
Thunderbird (Windows/macOS/Linux)   IMAP + SMTP             CalDAV/CardDAV (built in)
Browser                             Webmail /mail/          Webmail /mail/

"Exchange" account type in Outlook for Windows: not supported (requires MAPI over HTTP)
iPhone, iPad and macOS: setup profile via QR code or link, see chapter 09

Settings, Default Values & Best Practices

Setting / Location	Description	Default Value	Production Best Practice
`Posteingang: IMAP, Port 993, SSL/TLS`	Mail, folders and read state via IMAPS with TLS from the first byte. Special folders (Sent, Drafts, Trash, Junk) are announced by the server via IMAP SPECIAL-USE.	`993 · SSL/TLS`	Use port 993 with SSL/TLS. Port 143 with STARTTLS is only an optional fallback and must be opened separately in the firewall.
`Postausgang: SMTP, Port 465 (SSL/TLS) oder 587 (STARTTLS)`	Submission for authenticated users. Port 465 encrypts immediately (implicit TLS); port 587 starts in plain text and upgrades to TLS via STARTTLS before authentication.	`465 · SSL/TLS`	In Outlook, enable "My outgoing server requires authentication" and use the same credentials as for incoming mail. Port 25 is for server-to-server delivery only.
`Benutzername & App-Passwort (2FA)`	All client protocols sign in with the full email address. With 2FA enabled, the normal password is rejected for IMAP, SMTP and DAV.	`E-Mail-Adresse`	Create a separate App Password per device and program (Webmail -> Settings -> 2FA, Passkeys & Password) so you can revoke individual access selectively.
`CalDAV-Kalender: /dav/calendars/<adresse>/default/`	Default calendar of the mailbox for CalDav Synchronizer and other CalDAV clients (VEVENT, including invitations and recurring series).	`https://<host>/dav/calendars/<adresse>/default/`	Verify with the "Test or discover settings" button in CalDav Synchronizer; alternatively, https://<host>/.well-known/caldav is enough as the starting point for discovery.
`CardDAV-Kontakte: /dav/addressbooks/<adresse>/default/`	Default address book of the mailbox (vCard 3.0/4.0) for CalDav Synchronizer, Thunderbird, macOS and DAVx5.	`https://<host>/dav/addressbooks/<adresse>/default/`	Use a dedicated Outlook contacts folder for syncing so that local contacts of other accounts are not mixed in. Discovery: https://<host>/.well-known/carddav.
`CalDAV-Aufgaben: /dav/calendars/<adresse>/tasks/`	Task list (VTODO) of the mailbox, the same tasks as in Webmail and on the phone.	`https://<host>/dav/calendars/<adresse>/tasks/`	Create a third profile in CalDav Synchronizer and select the Outlook tasks folder.
`Neues Outlook für Windows`	Supports nextxch only as an IMAP account for mail. CalDAV, CardDAV and COM add-ins such as CalDav Synchronizer are not available in the new Outlook.	`IMAP · nur E-Mail`	If you need calendars and contacts in Outlook, use classic Outlook with CalDav Synchronizer or the nextxch Webmail (/mail/).
`Kontotyp "Exchange" in Outlook für Windows`	Outlook for Windows connects Exchange-type accounts via MAPI over HTTP; the new Outlook connects Exchange accounts only through Microsoft services. nextxch does not implement MAPI.	`Nicht unterstützt`	Always choose IMAP. A failing Exchange setup is not a server misconfiguration.