How to Fix Thunderbird “Server Does Not Support TLS 1.2” Security Warning

If Thunderbird says your mail server does not support TLS 1.2, the safest fix is usually not to weaken Thunderbird. First confirm that the incoming and outgoing server names, ports, and connection-security choices match the settings published by your email provider. If those settings are correct and the warning remains, the server itself may still be limited to obsolete TLS 1.0 or TLS 1.1 and needs to be upgraded by the provider or administrator.

TLS, or Transport Layer Security, is the protocol that encrypts the connection between Thunderbird and a mail server. Thunderbird 78, released July 17, 2020, disabled TLS 1.0 and TLS 1.1 by default. Mozilla’s current support guidance still treats lowering the minimum TLS requirement as a temporary diagnostic measure that reduces security, not as the preferred permanent fix. See the Thunderbird 78 release notes and Mozilla’s Thunderbird 78 FAQ.

What You Need Before You Change Anything

Have the email provider’s current setup instructions open in a browser. You need the exact incoming server name, outgoing SMTP server name, port numbers, connection security, and authentication method. Do not assume that a port you used years ago is still correct.

Three terms matter here:

• IMAP or POP is the protocol Thunderbird uses to receive mail. IMAP normally keeps mail synchronized with the server; POP normally downloads messages.
• SMTP is the protocol used to send mail.
• SSL/TLS and STARTTLS are two ways of establishing an encrypted connection. SSL/TLS starts encrypted immediately. STARTTLS begins the connection first and then upgrades it to TLS. Use whichever mode your provider documents for the specific port.

If this is a company, school, or self-hosted mailbox, ask the mail administrator for the supported TLS versions and the approved IMAP/POP and SMTP endpoints. A security warning can be caused by the server itself, but it can also appear when Thunderbird is pointed at an old hostname, legacy proxy, or outdated gateway.

Step 1: Confirm Which Side Is Failing

Notice whether the problem happens when receiving mail, sending mail, or both. If receiving fails, focus first on the incoming IMAP or POP settings. If sending fails, inspect SMTP. If both fail immediately after a provider migration or a Thunderbird update, check both because they may use different hostnames and ports.

Mozilla’s current troubleshooting pages recommend comparing Thunderbird with the provider’s documented settings before changing anything else. The official guides for receiving problems and sending problems both call out outdated TLS as one possible cause.

Step 2: Check the Incoming Server Settings

Open Thunderbird’s application menu and choose Account Settings. Select the affected account, then open Server Settings. Compare the server name, port, connection security, authentication method, and username with your provider’s current instructions.

Do not change a working secure setting to None just to make the warning disappear. That can remove transport encryption and may expose credentials or message traffic. Mozilla’s account-settings documentation describes SSL/TLS as the recommended encrypted option when available and explains STARTTLS as an upgrade from an initially unencrypted connection. See Configuration Options for Accounts.

Step 3: Check the Outgoing SMTP Settings Separately

In Account Settings, select Outgoing Server (SMTP), choose the server assigned to your email account, and edit it. Compare the SMTP hostname, port, connection security, authentication method, and username with the provider’s published values.

Port 587 is commonly paired with STARTTLS and port 465 is commonly used for implicit TLS, but these are not universal rules you should force onto an account. The provider’s documentation is the source of truth. Also verify that the right SMTP server is assigned to the right identity; Thunderbird’s official sending guide notes that using another account provider’s SMTP service can fail.

Step 4: Test Again Before Touching Advanced TLS Preferences

Save the corrected account settings and restart Thunderbird. Try receiving mail, then send a short test message to an address you control. If one direction works and the other does not, you have narrowed the problem to incoming mail or SMTP.

If the TLS warning still appears, contact the provider or administrator and ask a direct question: Does this specific mail endpoint support TLS 1.2 or later? Give them the hostname and port Thunderbird is using. This avoids a common dead end where support confirms that “the service supports TLS 1.2” but a particular legacy IMAP, POP, SMTP, proxy, or load-balancer endpoint does not.

Step 5: Use Config Editor Only as a Temporary Diagnostic

Thunderbird includes an advanced preferences page called Config Editor, also known as about:config. Mozilla explicitly says this tool is intended for advanced use and that non-default changes are unsupported because they can break Thunderbird or complicate troubleshooting. The current path is Menu > Settings > General, scroll to the bottom, then choose Config Editor. See Mozilla’s official Config Editor documentation.

For older servers, Mozilla’s Thunderbird 78 FAQ documents changing security.tls.version.min to a lower value as a way to test whether obsolete TLS is the cause. If doing that suddenly makes mail work, you have confirmed a server-side compatibility problem. It does not mean the weaker setting is a good long-term solution.

After the test, restore the preference to its default value. In current Thunderbird, changed preferences are shown in bold and the revert control can return them to default. Then ask the provider to enable TLS 1.2 or later, move the mailbox to a supported endpoint, or give you updated connection settings.

Why Lowering TLS Permanently Is a Bad Fix

TLS 1.0 and TLS 1.1 are obsolete protocols. Thunderbird disabled them by default for a reason. Leaving an old protocol enabled increases exposure to protocol weaknesses and makes the client accept security that modern software no longer considers appropriate. If the mailbox is business-critical and the server cannot be upgraded immediately, treat any temporary compatibility change as an exception with a defined end date, not a normal configuration.

For a personal mailbox hosted by a third party, the practical decision may be to move to the provider’s modern mail endpoint or choose a provider that supports current TLS. For an internal server, the durable fix belongs on the mail server, reverse proxy, load balancer, or TLS-terminating gateway.

Common Mistakes to Avoid

• Changing the password first. A TLS protocol mismatch happens before normal mailbox authentication completes, so resetting a password usually does not solve this warning.
• Switching Connection Security to None. That may remove encryption rather than fix TLS support.
• Assuming IMAP and SMTP use the same endpoint. They often have different hostnames, ports, and TLS modes.
• Copying port numbers from a random forum. Use the provider’s current documentation.
• Leaving a lowered TLS minimum enabled. If it was used to diagnose an old server, revert it after the test.
• Ignoring VPN, antivirus, proxy, or firewall interception. Mozilla notes that these products can block or intercept mail connections, especially after a Thunderbird update. If the provider confirms TLS 1.2 support, test whether local network-security software is interfering.

How to Tell That the Fix Worked

A successful repair has three signs: Thunderbird receives new mail without the TLS warning, a test message sends successfully through the configured SMTP server, and you did not need to leave insecure TLS compatibility enabled. If only one direction works, revisit the corresponding incoming or outgoing settings. If neither direction works and the provider confirms the hostname supports TLS 1.2 or later, investigate firewall, VPN, proxy, antivirus, certificate, or network-path issues next.

When You Should Stop Troubleshooting Locally

Stop changing Thunderbird settings when the account matches the provider’s published configuration and the provider confirms that the exact endpoint is limited to TLS 1.0 or 1.1. At that point the client is doing what it is designed to do: refusing a connection below its security floor. The durable resolution is a server upgrade or migration.

If you manage the server yourself, verify the TLS configuration on the service that actually terminates the connection, not only on the mail application. In some deployments a proxy or gateway handles encryption in front of IMAP or SMTP. Upgrading the back-end mail software alone will not help if the TLS-terminating layer still offers only obsolete protocol versions.

Bottom Line

For a Thunderbird “Server does not support TLS 1.2” warning, start with the provider’s current IMAP/POP and SMTP settings, correct any outdated hostnames, ports, or security modes, and retest. Use Thunderbird’s advanced TLS preference only as a short diagnostic for a legacy server. If the test confirms obsolete TLS, restore the default and fix the server side. That approach resolves the real problem without silently trading away connection security.