Thunderbird stopped working for dsl.ppex.com

[cmhuddart101]

my legacy (20 plus years old) dsl.pipex.com email has stopped accepting the password. Pipex happened to be the first and cheapest adsl service at my exchange so I signed up.

When went sold out to tiscali it worked then I moved isp due dire tiscali speed and relaibility.
Since then the mail been active via talktalk who took over from tiscali when they went bust.
I've always kept this legacy account as it worked and most people know it! 

Firstly the webmail portal works with my email account and password as does the link to gmail link and the account that's setup on my mobile since forever.

Thunderbird has stopped working for W10 on Thunderbird. roughly 2 months or so ago
Having deleted the account from thunderbird the recreation process creates one of these combinations.

inbound

server imap.dsl.pipex.com port 993 or mail.talktalk.net

security starttls or ssl/tls

auth "normal passwd"
Outbound
server smtp.dsl.pipex.com or smtp.talktalk.net
security starttls

auth "normal passwd"
Ping test shows all servers active via ping.
telnet to to the above connects
port 143 replies with starttls preamble but rejects the password that works as described above.
port 993 contents in same way as my other mail accounts.
The pipex mail has some important archived mail that isn't readily visible from the working sources.

This is really annoying that changing some connection details without defining what needs change. I suspect it's to do with the way the imap directory are being mapped or the account name format that's wrong but with no information to correct the settings.
I have not found combination of setting that works!!! so it is definitely on server side that rejecting it.

[Chris-TalkTalk]

Hi cmhuddart101,

Sorry, I can't see any TalkTalk email in your profile, did you add it to the private notes section?

Chris

[cmhuddart101]

Try looking now. Have re-added the root email and alias for my dsl.pipex.com

[Ady-TalkTalk]

There's no TalkTalk mail address in your profile. 

Ady

[cmhuddart101]

Hi ady,

I added the email details to my profile. Not why talktalk thinks using thunderbird is insecure. The settings default to ssl/tls with tls1.2 or 1.3. The version depends version.

I have awfull http mail system. The new https mail portal is better but not as flexible as Thunderbird.

[Ady-TalkTalk]

Please add your affected TalkTalk mail address to private notes in your community profile and I'll get your access restored to full. 

Ady

[cmhuddart101]

Not sure what talktalk's intent was but having the only way view my mail is via the web portal or vua an outlook/gmail via thier.

 imap and pop3 access us disabled either by design or is misconfiged for tls1.3 client connects.

Outlook/ Thunderbird and android clients will not downgrade connection encryption once started. Server to server with smtp will try tls1.3 followed by tls1.2 if the header contains a starttls flag. Tls1.2 is a defacto method for smtp with 99.99% of servers supporting it. Tls1.3 is only supported by approximately % of mail servers despite being published about a decade ago! The published details are misleading since the server mail.talktalk.net and imap.dsl.pipex.com both resolve to same ip meaning there is nor has there ever been a dedicated pipex.com mail server. Even when pipex existed they a 3rd party mail system.

[cmhuddart101]

Hi Ady,

The settings are as per the published information. However the tls reply in the tls 1.3 intial handshake asks to revert to tls 1.2 after accepting a tls 1.3 connection. Tls should reply with the session cypto key. Unlike tls 1.2 tls 1.3 should reply the session ae256 key hash.

[Ady-TalkTalk]

Hi cmhuddart101, you're not using the secure settings we are now enforcing. You'll have received mail with details of the settings and the implications of failing to change to those settings. We will have limited your account to webmail only until you change the settings to those we require you to use. You can find the settings you should be using in the Email Settings help article. Once you've changed to the correct settings please add the affected email address to private notes and I'll get that unlimited for you.

Ady

[cmhuddart101]

Ok after some further investigation.
tls 1.2 to one other accounts. i see this.
304 14.502182 192.168.0.2 213.120.69.4 TLSv1.2 571 Client Hello

Outbound connection to imap server from thunderbird
306 14.515497 213.120.69.4 192.168.0.2 TLSv1.2 1500 Server Hello

reply from imap server
308 14.515497 213.120.69.4 192.168.0.2 TLSv1.2 771 Certificate, Server Key Exchange, Server Hello Done

cert  exchange for tls 1.2
whereas
the server doesn't reply to talktalk client hello.

this clearly a config issue with a imap cert.

[cmhuddart101]

having looked at the traffic it looks talktalk have done something to tls.
The the tls stream in this trace is EMTPY of data.
39 146.403246 192.168.0.2 153.92.174.228 TLSv1.3 571 Client Hello  
40 146.437086 153.92.174.228 192.168.0.2 TCP 54 993 → 58336 [ACK] Seq=1 Ack=518 Win=64128 Len=0
41 146.440457 153.92.174.228 192.168.0.2 TLSv1.3 1500 Server Hello, Change Cipher Spec, Application Data
42 146.440457 153.92.174.228 192.168.0.2 TCP 1500 993 → 58336 [PSH, ACK] Seq=1447 Ack=518 Win=64128 Len=1446 [TCP segment of a reassembled PDU]
43 146.440457 153.92.174.228 192.168.0.2 TCP 1500 993 → 58336 [ACK] Seq=2893 Ack=518 Win=64128 Len=1446 [TCP segment of a reassembled PDU]
44 146.440457 153.92.174.228 192.168.0.2 TCP 1500 993 → 58336 [PSH, ACK] Seq=4339 Ack=518 Win=64128 Len=1446 [TCP segment of a reassembled PDU]
45 146.441051 192.168.0.2 153.92.174.228 TCP 54 58336 → 993 [ACK] Seq=518 Ack=2893 Win=131584 Len=0
46 146.441230 192.168.0.2 153.92.174.228 TCP 54 58336 → 993 [ACK] Seq=518 Ack=5785 Win=131584 Len=0
47 146.442019 153.92.174.228 192.168.0.2 TCP 1500 993 → 58336 [ACK] Seq=5785 Ack=518 Win=64128 Len=1446 [TCP segment of a reassembled PDU]
48 146.442019 153.92.174.228 192.168.0.2 TCP 1500 993 → 58336 [ACK] Seq=7231 Ack=518 Win=64128 Len=1446 [TCP segment of a reassembled PDU]
49 146.442019 153.92.174.228 192.168.0.2 TLSv1.3 1385 Application Data, Application Data, Application Data
50 146.442465 192.168.0.2 153.92.174.228 TCP 54 58336 → 993 [ACK] Seq=518 Ack=8677 Win=131584 Len=0
51 146.452209 192.168.0.2 153.92.174.228 TLSv1.3 134 Change Cipher Spec, Application Data
52 146.484129 153.92.174.228 192.168.0.2 TCP 56 993 → 58336 [ACK] Seq=10008 Ack=598 Win=64128 Len=0
53 146.484673 153.92.174.228 192.168.0.2 TLSv1.3 596 Application Data, Application Data
54 146.484912 153.92.174.228 192.168.0.2 TLSv1.3 157 Application Data
55 146.485048 192.168.0.2 153.92.174.228 TCP 54 58336 → 993 [ACK] Seq=598 Ack=10653 Win=131584 Len=0
56 146.486579 192.168.0.2 153.92.174.228 TLSv1.3 99 Application Data
57 146.518972 153.92.174.228 192.168.0.2 TCP 56 993 → 58336 [ACK] Seq=10653 Ack=643 Win=64128 Len=0
58 146.519201 153.92.174.228 192.168.0.2 TLSv1.3 80 Application Data
59 146.520022 192.168.0.2 153.92.174.228 TLSv1.3 102 Application Data
60 146.555014 153.92.174.228 192.168.0.2 TCP 56 993 → 58336 [ACK] Seq=10679 Ack=691 Win=64128 Len=0
61 148.741710 153.92.174.228 192.168.0.2 TLSv1.3 129 Application Data
62 148.742624 192.168.0.2 153.92.174.228 TLSv1.3 99 Application Data
63 148.774735 153.92.174.228 192.168.0.2 TCP 56 993 → 58336 [ACK] Seq=10754 Ack=736 Win=64128 Len=0
64 152.777413 153.92.174.228 192.168.0.2 TLSv1.3 92 Application Data
65 152.778275 192.168.0.2 153.92.174.228 TLSv1.3 90 Application Data
66 152.810929 153.92.174.228 192.168.0.2 TCP 56 993 → 58336 [ACK] Seq=10792 Ack=772 Win=64128 Len=0
67 152.811064 153.92.174.228 192.168.0.2 TLSv1.3 92 Application Data
68 152.812101 192.168.0.2 153.92.174.228 TLSv1.3 90 Application Data
69 152.844456 153.92.174.228 192.168.0.2 TCP 56 993 → 58336 [ACK] Seq=10830 Ack=808 Win=64128 Len=0
70 154.743059 153.92.174.228 192.168.0.2 TLSv1.3 129 Application Data
71 154.745282 192.168.0.2 153.92.174.228 TLSv1.3 108 Application Data
72 154.777397 153.92.174.228 192.168.0.2 TCP 56 993 → 58336 [ACK] Seq=10905 Ack=862 Win=64128 Len=0
73 160.741994 153.92.174.228 192.168.0.2 TLSv1.3 129 Application Data
74 160.787148 192.168.0.2 153.92.174.228 TCP 54 58336 → 993 [ACK] Seq=862 Ack=10980 Win=131256 Len=0
75 162.658516 192.168.0.2 153.92.174.228 TLSv1.3 99 Application Data
76 162.691576 153.92.174.228 192.168.0.2 TCP 56 993 → 58336 [ACK] Seq=10980 Ack=907 Win=64128 Len=0
77 162.692241 153.92.174.228 192.168.0.2 TLSv1.3 80 Application Data
78 162.694471 192.168.0.2 153.92.174.228 TLSv1.3 102 Application Data
79 162.726633 153.92.174.228 192.168.0.2 TCP 56 993 → 58336 [ACK] Seq=11006 Ack=955 Win=64128 Len=0

The system connects but nothing is retuned from server.