Your question
Hello, the account was setup correctly in outlook, and it seems it logs in to the account. but no emails are shown. In Thunderbird and Bulwark Webmail everything is fine. What could be the reason?
The thing to check first is where the connections are actually coming from. New Outlook does not talk IMAP from the desktop: Microsoft’s cloud sync service connects to your server on the user’s behalf, from Microsoft IP ranges. So the account setup succeeding tells you the credentials are fine, but the sync itself is a different client from a different address, which is why Thunderbird from your own machine is unaffected.
Have a look at Security > Blocked IPs and filter for Microsoft ranges. If any are there, add them under Allowed IPs; the allowlist overrides the blocklist. This bites people often enough that it is worth ruling out before digging into IMAP itself.
If that is clear, could you send the IMAP telemetry for one Outlook sync session, specifically whether it gets as far as SELECT INBOX and what the FETCH and SEARCH responses look like? Also useful: your server version, whether the folder tree shows up with an empty Inbox or nothing appears at all, and whether maxConcurrent, maxRequestRate, maxMessagesPerCommand or maxMessagesPerSave have been changed from their defaults.
Hello,
how do I know which ranges are from microsoft?
there are quite a lot blocked ip adresses there…
actually over 1500.
I saw now the ms ip, it is not blocked.
How do I get the whole Imap telemetry?
The Folder Tree does not show up.
Server is 0.16.18.
Don’t enumerate Microsoft’s ranges by hand. Sort Blocked IPs by createdAt around the time of a failed sync attempt; each entry also carries a reason (authFailure, loitering and so on), which usually identifies the client faster than the address does. AllowedIp.address takes a CIDR mask, so one entry covers a whole range once you know which one you need.
1500 blocked entries is a lot for one server, and that many suggests something is tripping the thresholds constantly. They live on the Security singleton, authBanRate defaulting to 100/day and loiterBanRate to 150/day: Auto-banning | Stalwart
For the trace, Live Telemetry is an Enterprise feature, so on community edition add a Log tracer under Settings > Telemetry > Tracers with level: trace and an include events policy listing imap.raw-input, imap.raw-output and imap.error. The raw events are trace level, so a debug tracer will not emit them (Log file | Stalwart). What I want out of it is whether the session gets past AUTHENTICATE at all, and what the server answers to LIST. No folder tree whatsoever points at the session ending before or during LIST, which is a different problem from a FETCH failure.
I’m having the “same” problem:
```
Stalwart version: 0.16.20
Docker, Linux amd64, RocksDB
Messages are delivered correctly to INBOX.
Raw IMAP test using UIDONLY works:
SELECT INBOX → 1 EXISTS
UID SEARCH ALL → SEARCH 1
UID FETCH → returns message headers
However, New Outlook sync connections from Microsoft IPs repeatedly produce:
Message numbers are not allowed once UIDONLY is enabled
code = UIDREQUIRED
The client authenticates successfully but does not display the Inbox messages.
No Microsoft IPs are blocked.
```
Looks like the latest update few minutes a go fixed it v0.16.21.