Email Security

How Your Mail Client Finds Its Server, and What Leaks in the Process

August 13, 2026 9 min read Haven Team

Setting up email used to mean typing in four hostnames, two port numbers, and picking the right encryption setting from a dropdown. Now you type an address and a password and it works. The step that disappeared did not go away; it moved into a background protocol that runs before you are authenticated, over a network you may not control, guessing at server names. In 2021, a researcher pointed that guessing at himself and collected several hundred thousand corporate credentials.


Mail account setup has a bootstrap problem. The client knows one thing about you, your address, and needs to learn four or five things it cannot derive from it: the IMAP or POP host, the submission host, the ports, the encryption mode, and the username format, which is sometimes the full address and sometimes only the part before the at sign. There is no field in the address that carries any of this.

Three different discovery mechanisms grew up to fill that gap, none of them universal, all of them still running today.

The three protocols competing to answer one question

Mozilla Autoconfig

Thunderbird and several other clients look for an XML document describing the provider's settings. The lookup order matters more than the format. The client checks for a configuration served under the mail domain itself, typically at a well-known path or an autoconfig subdomain. If that fails, it queries a central database hosted by Mozilla, sending the domain part of the address so the service can return settings for known providers. If that fails, it tries the mail exchanger for the domain. Only after all of that does it fall back to guessing conventional names like imap.example.com and mail.example.com, probing each one to see what answers.

Microsoft Autodiscover

Exchange clients follow a different sequence, POSTing an XML request to a series of candidate URLs derived from the address domain. It tries the domain root, then an autodiscover subdomain, then a DNS SRV record, then a handful of other paths. The behaviour that caused the trouble is the back-off step: some implementations, having exhausted the domain, strip a label and try the parent. An address at mail.corp.example.com ends up asking autodiscover.example.com, and in the worst implementations, an address at example.com ends up asking autodiscover.com.

DNS SRV records (RFC 6186)

The standards-track answer, published in 2011, defines SRV records that let a domain publish its own submission, IMAP, and POP endpoints in DNS: _submission._tcp, _imaps._tcp, and their siblings. It is the cleanest of the three and the least universally implemented, which is a familiar pattern in email.

Why the fallback chain is the risk

Each mechanism has a defined first choice that is safe. The exposure lives in what happens after the first choice fails, because every one of these protocols degrades toward guessing, and a guess is a query sent to a host nobody vetted.

The Autodiscover leak

In September 2021, Amit Serper at Guardicore published research on what happens when the Autodiscover back-off reaches a domain the organisation does not own. He registered a set of autodiscover.<tld> domains across several country code TLDs, pointed them at a web server, and waited.

Clients came. Over roughly four months the server received requests carrying more than 300,000 sets of Windows domain credentials, a large share of them sent as HTTP Basic authentication, which is to say the password in a header, base64 encoded and not encrypted in any meaningful sense. The clients were not compromised. They were following the protocol's fallback logic to a domain that happened to be owned by a stranger.

The research also documented a downgrade path: a server that rejected an authenticated request could prompt the client to retry with a weaker authentication scheme, and some clients complied, turning a challenge-response exchange into a plaintext one.

Microsoft disputed the framing and noted that the behaviour depends on client implementation and network configuration. Both things are true at once. The protocol did not require anyone to send credentials to an unrelated domain, and a meaningful number of deployed clients did it anyway.

What discovery reveals even when nothing goes wrong

Set aside credential leakage and the mechanism still has a privacy profile. Before any encrypted session exists, the client emits a sequence of observable signals.

Step Who learns something What they learn
DNS lookups for candidate hosts Your resolver, your network operator Which provider you use, and that you are configuring a new client right now
Central config database query The database operator Your mail domain and your client's address, at setup time
Probing conventional hostnames Whoever controls those names That an unconfigured client is looking for a server, plus whatever the client sends
Plaintext or downgraded fallback Anyone on the network path Potentially the username and password themselves

The DNS layer alone is worth pausing on. Configuring a work account from a hotel network announces your employer's mail domain to that network before you have sent a single message. This is the same category of exposure covered in our piece on DNS leaks, arriving through a channel most people never think of as a network protocol at all.

What actually fixes it

The mitigations divide cleanly into things a domain operator controls and things a user controls.

If you run the domain:

If you are the one setting up a client:

The pattern this belongs to

Email's discovery mechanisms share a shape with several other pieces of the ecosystem: a convenience layer, added later, that runs before the security layer it is supposed to configure. Web Key Directory handles the same bootstrap problem for OpenPGP keys and solves it by pinning discovery to an HTTPS path under the mail domain itself, with no fallback to guessing. MTA-STS does the equivalent job for server-to-server delivery, publishing a policy that says which hosts are legitimate and that TLS is not optional.

Both are worth reading as design contrasts. They answer a discovery question with a single authoritative source rather than a chain of increasingly desperate attempts, and the absence of a fallback is the security property.

The broader lesson generalises past email. Any protocol whose failure mode is "try something less specific" will eventually try something owned by someone else. If you are auditing a system, the interesting question is rarely what it does when everything resolves correctly. It is what it does on the fourth attempt.

For the adjacent surfaces, our write-ups on reading email headers and corporate TLS interception cover what remains visible after setup succeeds and the session is encrypted.

Try Haven free for 15 days

Encrypted email and chat in one app. No credit card required.

Get Started →