Exchange mail flow guides › Inbound: POP3 and IMAP retrieval
How to download POP3 and IMAP mailboxes into Exchange Server 2016, 2019 and SE
To bring provider POP3 or IMAP mailboxes into an on-premises Exchange Server you run a connector service that logs in to each mailbox on a schedule, downloads the messages and submits them to Exchange over SMTP through a receive connector that allows relay from the connector’s IP. Exchange itself has no such connector (see Does Exchange Server have a built-in POP3 connector?), so the work splits into two halves: a short preparation on the Exchange side and the account setup in the connector. This guide uses POPcon for the connector half.
Updated on 2026-09-14
The Exchange steps follow our Exchange 2013 / 2016 configuration guide. Exchange 2016 and 2019 manage receive connectors in the same place, the Exchange admin center under Mail flow › Receive connectors, as described on Microsoft Learn under Receive connectors in Exchange Server; POPcon supports Exchange Server SE as well (requirements).
What you need before you start
| Item | Where | Why |
|---|---|---|
| Your internet domain as an accepted domain | Exchange admin center › Mail flow › Accepted domains | Exchange rejects delivery for a domain it does not own with 550 5.7.1 Unable to relay |
| Mailboxes that carry the provider addresses | E-mail address policy or the individual recipient | The connector hands each message to a recipient address; Exchange must know that address |
| Provider server name, protocol and port | Your provider’s help pages | POP3 110, POP3-SSL 995, IMAP 143, IMAP-SSL 993 are the defaults |
| Mailbox login, or OAuth 2.0 for Microsoft 365 and Gmail | Microsoft 365 walkthrough, Gmail walkthrough | These two providers are connected through a Microsoft or Google sign-in instead of a stored password |
| A Windows machine for the connector | The Exchange server or any other Windows Server / Windows 7 to 11 machine | The service needs about 10 MB plus space for messages waiting to be forwarded |
| TCP port 25 open from that machine to Exchange | Windows firewall and any firewall in between | The handover to Exchange is plain SMTP on port 25 |
| A postmaster mailbox in Exchange | Any real mailbox, for example the administrator | Receives every message whose recipient cannot be resolved, and status notifications |
Step 1: Add your internet domain to the accepted domains
Open the Exchange admin center (https://<server>/ecp), go to Mail flow and select Accepted domains. The default entry is usually the internal Active Directory domain; leave it and add a new one with the + icon. Enter a descriptive name, the internet domain the provider mailboxes belong to, and select Authoritative domain, which tells Exchange that this server holds every mailbox of that domain. Save. If you skip this step, every message the connector submits is refused with 550 5.7.1 Unable to relay, the single most common error in a fresh setup (knowledge base article).
While you are in the admin center, make sure the users have SMTP addresses in that domain. The e-mail address policy under Mail flow › Email address policies assigns them in one format to all current and future users; the configuration guide shows the dialog, together with the send connector for outbound mail.
Step 2: Let the receive connector accept mail from the connector
POPcon delivers to Exchange over SMTP without authentication, so the receive connector that answers on port 25 has to accept anonymous connections from the connector’s IP address. Under Mail flow › Receive connectors select the Default Frontend connector and edit it:
- General: raise Maximum receive message size from the default 10 MB to 100 MB, so larger messages do not get stuck between the connector and Exchange. You can limit sizes again later in the organisation settings or per mailbox, and Exchange will then return a non-delivery report for oversized mail.
- Security: tick Anonymous users under permission groups. Without it Exchange answers
530 5.7.1 Client was not authenticated(knowledge base article). - Scoping: check that the remote IP ranges include the machine the connector will run on, and that the network adapter bindings show the server’s IP address or All available IPv4 on port 25. The FQDN field does not matter for POPcon.
Two notes. First, do not install the Windows Simple Mail Transfer Protocol feature on the Exchange server: it would compete with the Exchange transport for port 25. Second, this is not an open relay: the anonymous permission lets the connector deliver to your own accepted domains only. A separate relay connector, as described in Microsoft’s Allow anonymous relay on Exchange servers, is only needed when a device or application must send to external recipients through Exchange, which a POP3 connector never does.
Step 3: Install the connector and add the provider mailboxes
Download POPcon, run the installer on the machine you chose and start POPcon Administrator. It installs the POPcon service that does the work in the background and the administrator program you configure it with. Click Configure and work through three tabs:
- General: enter the postmaster address. Use a real mailbox inside Exchange; messages without a valid recipient are forwarded there, and a non-existent postmaster means they are lost. The log options can stay at their defaults.
- POP3/IMAP: click Add for each provider mailbox. Choose the server type (POP3, POP3-SSL, IMAP or IMAP-SSL), enter the server name, user name and password, and the port if it differs from the default for that type. Then decide the mailbox type: a single-user mailbox delivers everything to one Exchange recipient you name here, a catch-all mailbox receives mail for the whole domain and is split by the recipient headers. For catch-all accounts enter your domain, without the
@, in the Accepted recipient domains box; that is how POPcon tells local recipients from the rest (why the accepted domains matter). Finally choose whether downloaded mail is deleted at the provider, left there indefinitely, or left for a number of days. Microsoft 365 and Gmail accounts are connected with the OAuth2 button instead of a password; the walkthroughs are in the knowledge base (Microsoft 365, Gmail). - Exchange: enter the Exchange server’s network name, for example
MAILSERVER, not your internet domain. Everything else can stay at its default.
The individual settings are described on the POP3/IMAP configuration page, the schedule on the scheduling page.
Step 4: Test the first retrieval cycle
Confirm the configuration with OK and click Trigger mail retrieval on the main screen. The scrolling log shows the login to the provider mailbox, each downloaded message and the SMTP handover to Exchange; the same text goes to POPconSrv.log in the POPcon program folder. A clean cycle ends with the messages in the Exchange mailboxes. Then set the schedule: the simple mode waits a fixed number of minutes between cycles, down to 1 minute, and 0 means continuous retrieval; the complex mode runs at exact times per weekday. From here on the service works without the administrator program being open.
When it does not work
Almost every failed first setup lands in one of these rows. The log line tells you which.
| Symptom | Usual cause | Fix |
|---|---|---|
| Messages download, nothing reaches Exchange | Wrong server name on the Exchange tab, transport service not running, port 25 blocked | Downloads fine but cannot reach Exchange: ping, telnet server 25, services, firewall, receive connector |
| “Could not reach Exchange SMTP server — check that IP port 25 is not blocked” | Firewall between the machines, or the connector’s IP is not in the receive connector’s remote IP ranges | knowledge base article; step 2, Scoping |
550 5.7.1 Unable to relay | The recipient domain is not an accepted domain | Step 1; knowledge base article |
530 5.7.1 Client was not authenticated | Anonymous users not ticked on the receive connector | Step 2; knowledge base article |
| Every message goes to the postmaster: “no local recipients” | Accepted recipient domains missing or entered with an @ | knowledge base article; step 3, POP3/IMAP tab |
| Large messages never arrive | Receive connector still at the 10 MB default | Step 2, General; the waiting messages are resent from the TOOLARGE folder once the limit is raised |
Frequently asked questions
Does the connector have to run on the Exchange server itself?
No. POPcon runs as a Windows service on Windows Server 2012 to 2025 or Windows 7 to 11, either on the Exchange server or on any other machine in the network. From a separate machine it must reach Exchange on TCP port 25, and the receive connector’s remote IP range has to include that machine’s address; otherwise the log shows that the Exchange SMTP server could not be reached.
POP3 or IMAP: which should I choose for the provider mailbox?
Both deliver the same messages into Exchange. POPcon supports POP3, POP3-SSL, IMAP and IMAP-SSL with the default ports 110, 995, 143 and 993; take the protocol and port your provider documents and prefer the encrypted variant. For Microsoft 365 and Gmail mailboxes the OAuth 2.0 walkthroughs in the knowledge base use IMAP. If another client reads the same mailbox, set the account to leave messages on the server for a number of days.
Can one provider mailbox for the whole domain serve every Exchange user?
Yes. Configure it as a catch-all mailbox and enter your domain in the accepted recipient domains list. POPcon reads the To:, CC:, X-Envelope-To, Delivered-To and other header fields of each message and delivers it to the matching Exchange mailbox. Messages without a recipient in one of the accepted domains go to the postmaster, or to a re-route address you configure for the account.
How often is mail collected?
With simple scheduling POPcon waits a fixed number of minutes between retrieval cycles, minimum 1 minute; the value 0 starts the next cycle immediately after the previous one. Complex scheduling lets you set exact retrieval times per weekday instead, for example every 30 minutes during business hours only. The Trigger mail retrieval button in POPcon Administrator starts a cycle at once.
More on inbound mail flow in the Exchange mail flow guides, or in the knowledge base. Auf Deutsch: POP3- und IMAP-Postfächer in Exchange Server 2016, 2019 und SE abholen.