Gmail in an email app on a work network or behind a firewall

If an email program (Outlook, Thunderbird, a phone email app) connects to Gmail without problems on one network but not on another, the fault is almost certainly not in the account but in the network or in security software running on the computer. A few simple tests show which one is the cause, and exactly what to ask the IT administrator for.

What does the email program need to reach?

In an email program, Gmail works over two channels: IMAP receives and syncs emails, and SMTP sends them. Since 2025, signing in almost always goes through the “Sign in with Google” window, which is a web page on Google's server. If any of these is unreachable, the program reports an error, often with a misleading message (“wrong password”, “timeout”, “the server is not responding”).

• Incoming mail (IMAP): imap.gmail.com, port 993, SSL/TLS encryption.
• Outgoing mail (SMTP): smtp.gmail.com, port 587 with STARTTLS, or port 465 with SSL/TLS. The outgoing server requires authentication.
• Sign-in: the “Sign in with Google” window opens accounts.google.com, which needs an HTTPS connection (port 443).
• Port 25 will not do: many internet providers and companies block outgoing port 25 outright, so the email program must use port 465 or 587 for SMTP.
• For anyone also using an Outlook.com account in the same program, its settings are covered in a separate guide: Setting up an Outlook.com account in another email app (IMAP, SMTP).

1. The network blocks the IMAP or SMTP port

Symptom: the program keeps trying for a long time, then stops with a timeout or a “could not connect” message. Meanwhile, Gmail on the web works in the browser on the same network. Cause: the firewall of the company, school, hotel or public network only lets web traffic through (ports 80 and 443), not email protocols. Many companies deliberately prevent employees' computers from connecting to outside email servers.

1. On Windows, the command Test-NetConnection imap.gmail.com -Port 993 in PowerShell checks the incoming port. If the output ends with “TcpTestSucceeded : True”, the port is open.
2. Test smtp.gmail.com the same way with ports 587 and 465.
3. On macOS and Linux, the command nc -vz imap.gmail.com 993 in the terminal gives a similar result.
4. If the command reports a timeout or a refusal, the port is closed on the network. Changing settings will not help in that case; contact the network operator.

2. The antivirus program or firewall inspects the encrypted connection

Symptom: the connection is established, but the program reports a certificate error (“the server's certificate is not trusted”), or the connection drops right after signing in. It often happens on one computer only, while others on the same network work fine. Cause: the email protection feature of some antivirus programs and many company firewalls inspect encrypted traffic by replacing Google's certificate with their own. Some email programs do not accept this.

• Test: briefly turn off the antivirus program's email scanning or SSL/TLS inspection feature and try connecting again. If it works this way, add the email program or Gmail's servers as an exception in the antivirus program, then turn the protection back on.
• Checking the certificate: the command openssl s_client -connect imap.gmail.com:993 shows who issued the certificate received. Gmail's certificate is issued by Google's own certificate authority (Google Trust Services); if another name appears (for example an antivirus or firewall vendor), an intermediate device is inspecting the traffic.
• On a work computer: the user often cannot change the antivirus and firewall settings at all. In that case, ask the IT administrator to exclude Gmail's servers from encrypted traffic inspection.
• Never accept a certificate error permanently in the email program or turn off certificate checking, because then the program would not flag a real attack either.

3. The sign-in window does not load or shows an error

Symptom: when adding the account, the email program shows an empty or broken window, or asks for the password again and again. Cause: the “Sign in with Google” window cannot reach accounts.google.com because a proxy or web filter blocks it; or the program is so old that it only tries to sign in with a username and password.

• Old program: from March 14, 2025, Google also ended password access for “less secure apps” on personal accounts: IMAP, SMTP and POP only work with Google sign-in (OAuth) or an app password. According to Google's help, older versions of Outlook 2016, for example, do not meet current requirements; updating the program is the fix.
• App password: can only be created with 2-Step Verification turned on, at myaccount.google.com/apppasswords, and Google does not recommend it if the program supports Google sign-in. It is not available for work or school accounts, with 2-Step Verification that uses only security keys, or with Advanced Protection. Google revokes app passwords when the password is changed.
• Web filter: if the sign-in window shows a company block page, ask the IT administrator to allow accounts.google.com.
• Too many connections: the “Too many simultaneous connections” error is not a network fault: a Gmail account can be added to at most 15 email programs at once, so sign out on old devices that are no longer used.

4. Work Google account: the administrator has not enabled it

If the address does not end in @gmail.com but in the company's or school's own domain (a Google Workspace account), access from email programs is controlled by the organization's administrator. IMAP must be enabled in the Admin console, and external email programs can also be blocked. For such accounts, the “Forwarding and POP/IMAP” tab in Gmail settings is not always visible either. For personal @gmail.com accounts, IMAP cannot be turned on or off since January 2025; it is always enabled.

What to ask the IT administrator for

Make the request specific: the administrator needs to know exactly what traffic to allow. Before asking, it is worth reading the workplace's IT policy, because many workplaces prohibit using personal email accounts on company computers. In that case, the solution is your own phone on mobile data, not getting around the firewall with a VPN or some other trick.

• Allow outgoing TCP connections to imap.gmail.com on port 993.
• Allow outgoing TCP connections to smtp.gmail.com on port 587 and/or 465.
• Access to accounts.google.com from the browser and from the email program's sign-in window (port 443).
• If the firewall or antivirus inspects encrypted traffic: exclude Gmail's servers from the inspection.
• When reporting the problem, include the exact error message, the time and the result of the port test.

Temporary solutions that do not break any rules

• Gmail on the web: if the browser can reach mail.google.com, emails can be read and sent there without an email program.
• The Gmail app on the phone: on mobile data, the restrictions of the company Wi-Fi do not apply.
• Guest or hotel network: if the email program does not connect, ask the network operator; until then, the web interface or mobile data can be used.