Imap email client no longer syncing

Yes, I can access my email at https://www.xfinity.com/email.

Thank you, here are a few additional tips to keep in mind: 

• If you're using another program or website to get your email, make sure it's not set to delete your email messages from the server automatically.
• There's a limit on the size of email messages.
  • If someone tries to send large videos or photos, you may not get them.
  • Our servers support messages up to 25 MB.
• Check your spam settings.
  • You can customize them to deliver it to a spam folder.
• While you're in Mail Settings, make sure you haven't turned on email forwarding.
• If you're missing a particular message, you can search your Inbox.

Full article at: https://www.xfinity.com/support/articles/top-tips-for-xfinity-connect

If you are still experiencing issues please send us a direct message with your full name and service address to get started. 

To send a direct message: 

Make sure you are signed in here in the Xfinity Forum. Click "Sign In" if necessary

• Click the "Direct Message" icon (square chat icon in the upper right corner of your screen next to the bell icon)
• Click the "New message" (pencil and paper) icon
• Type "Xfinity Support" in the "To:" line and select "Xfinity Support" from the drop-down list which appears. The "Xfinity Support" graphic replaces the "To:" line
• Type your message in the text area near the bottom of the window
• Press Enter to send it

Thank you Eva!  I will send the message as directed.

Thank you, @user_vn3lzc for your time and patience. Your imap.comcast.net connection error (0x800CCC0E) in Outlook, while SMTP works, usually points to incorrect SSL/TLS setting (993 for IMAP, needing a fresh password after security changes, or a Comcast setting like Third party access being off, which you can fix in web you can fix in Xfinity webmail settings. Check IMAP is enabled in webmail, verify your Outlook ports (993/SSL for IMAP, 587/STARTTLS for SMTP), and ensure you're using an app-specific password if 2FA is on, as Comcast sometimes blocks direct logins.-Richard

Hi Richard,

I confirmed my port settings.  Confirmed 3rd party apps allowed.  Reset my Xfinity password.  Turned off 2FA to see if that helped but still cannot connect to imap.comcast.com using Outlook (3rd party client) on WiFi / home network.  Outlook doesn't work on my iPhone either UNLESS I disconnect from my WiFi network at home.  When I'm using my cellular network connection my iPhone Outlook IMAP client syncs up my Comcast email.  When I enable WiFi again it won't sync.  Do you have an email firewall?  What are the logs showing for connections that are refused?  Just curious.

Thanks,
MI

aka  @user_vn3lzc

Good morning @user_8nli8o, and thanks for posting your issue to the Xfinity forums, I hope this message finds you well. I am sorry to hear that you are having issues with the email on your phone, but you have come to the right place for support. Have you tried deleting the email account from the phone and then adding it back on?

yes, I have tried all the normal suggestions. deleting, restarting, ensuring all the ports are correct (multiple times over different chat sessions) and nothing has worked. 

I am having the same issues as the above on all IOS products 

With pop up from IPhone 16 which says COMCAST is currently unavailable 

Hello, @user_ofgk8j which email client is no longer syncing to your iPad and iPhone? Is this Comcast email or a third party like Outlook, Gmail? 

Comcast email is not syncing.   All fine on desktop version, or going to browser on iPhone or iPad.  

Thanks for confirming! I would be happy to help with troubleshooting your email. When did you try those steps last?

The mail account is set up on iphone and ipad as incoming:  imap/comcast.net with correct user name and password, outgoing is smtp.comcast.net.  Use SSL as incoming setting. 

PW is correct, i can use it on the desktop.  

Mail does not synching.  I did start getting emails on these devices for a few days (12/11 Thurs to 12/23 Tues) then stopped again yesterday.  This is not a user issue, i have deleted and recreated the account -- when I could becuase there was a point when I could not create - it came back with the IMAP service "imap.comcast.net" is not responding.  I am on line, plenty of speed and bandwidth.   

@user_1adheu​

Ive been working all day on this, both my android and Thunderbird stopped working sometime Saturday Dec. 6th (I can still see my emails by logging in), Missing really important emails because there not coming to my phone anymore,   I understand they are moving our accounts to yahoo but tried putting Comcast address in there could not be found on yahoo???  

You'll be notified when it is time to move your email over to Yahoo! Mail.  Keep checking webmail.

What error messages are you getting on your phone and in Thunderbird?

No error messages on either andriod or thunderbird , Something happened last night December 9th it started working then stopped again, and worked again this morning and stopped again, Checked yahoo again my address is not there, Its not any of my settings something is going on with your mail servers?

@user_1adheu Did you receive an email about migrating to Yahoo? That process will not complete automatically and usually requires you to agree to it to complete.

This following link provides the settings necessary for each 3rd party email client. Can you verify yours match what is show here?

https://www.xfinity.com/support/articles/email-client-programs-with-xfinity-email

No this has not resolved and no restarting or rebooting fixes anything. Also there is no details on what 'suspicious' activity even means. I have sent 5 emails from my Comcast account in the last 2 weeks... to people I send to consistently. Hardly seems suspicious or excessive. This only ever happens with Comcast so seems your evaluation is the problem. 

The IMAP process appears to fail on login - which appears as a login password failure by the Outlook client.     In my case, when I connect the Outlook client via a cellular connection (T-mobile) - the login succussed and the client  is able to download and send emails normally.  When connected via the BAM ISP   - which uses Carrier Grade NAT  - the login fails with the error that suggests the IP address used by the NAT is blacklisted by Xfinity.   

If Xfinity blacklists based soley on IP address - this is a problem since CGNAT can aggregate many users into a single IP address.   Thus -  one abusive user on a CGNAT network can cause blacklisting for all other users.    Not good. 

@user_bvgs9o - Your assessment of the situation is spot-on. The Outlook error log explicitly flags the issue:

IMAP: [rx] z3o0 NO [ALERT] Temporarily blacklisted IP Address - try again later

Because BAM ISP utilizes Carrier-Grade NAT (CGNAT), hundreds or even thousands of independent subscribers share a single, public-facing IP address. If just one device sharing that IP sends high-volume outbound spam, runs a malicious botnet, or triggers automated failed login attempts, our security filters temporarily blacklist the entire IP address to protect the network. As noted, this is why switching to a T-Mobile cellular connection immediately works - it routes the traffic through a completely different, clean IP block.

While the temporary automated block usually clears on its own within 24 to 48 hours (provided the abusive behavior from the offending neighbor stops), waiting it out is not a reliable solution on a shared CGNAT network. To resolve this completely, there are some things you can try.

The automated system applied the block, but our specialized security team can manually review it. Contact our Customer Security Assurance (CSA) team at 1-888-565-4329 or visit their security portal at spa.xfinity.com. Explicitly state that you are experiencing an automated IMAP block ([ALERT] Temporarily blacklisted IP Address) because your internet service provider uses Carrier-Grade NAT. Provide them with your current public WAN IP address (which can be found by typing "what is my IP" into a browser while connected to the BAM network).

Because this issue can recur the moment another user on the same CGNAT pool misbehaves, the most permanent network-level fix lies with the provider. Contact BAM ISP customer support. Inquire if they offer a Static IP add-on or a publicly routable dynamic IP that pulls you out of the shared CGNAT pool. Many ISPs offer this for a small monthly fee, which completely isolates email and network traffic from the actions of other subscribers.

While waiting for network-level fixes, use these options to access email without interruption:

- Xfinity Webmail Portal: The temporary IP blacklist strictly targets the IMAP/POP3 authentication servers (imap.comcast.net). It does not block web traffic. You can log in and manage email normally by visiting connect.xfinity.com via a web browser on the BAM connection.

- Utilize a VPN: Running a reputable Virtual Private Network (VPN) on the computer will route the traffic away from the BAM CGNAT IP and through the VPN provider's IP space, bypassing the local block.

- Cellular Hotspot: Continue using the T-Mobile connection or mobile hotspot for Outlook syncing until the CSA team removes the block on the primary connection.

Please let us know how this goes, and our team remains here to help in any way we can! Appreciate you leaving comments with your shared concerns.

Hi Sara,  thank you for confirming my suspicions.  I found that VPN does not work on either BAM or Cellular, probably due to shared IP address provided by the VPN service.  Same issue likely.   Since CGNAT is growing popular with ISPs,  I implore Xfinity to change the way it detects abusive users.  The algorithm needs to track the TCP port number as well as IP address.   Comcast.net is the only IMAP provider that I've had this issue with, but I need to keep my comcast.net email address.  

Thanks again for your support.

It's my pleasure to help however I can, @user_bvgs9o. The frustration makes total sense, and the insight regarding the VPN is absolutely correct - many commercial VPN server IPs end up heavily flagged or blocked by mail servers for the exact same reason as a CGNAT pool.

The point about modifying the detection algorithm to track TCP port numbers alongside the IP address is incredibly sharp. In a CGNAT setup, the ISP uses Port Control Protocol (PCP) or Network Address Port Translation (NAPT) to assign specific source port ranges to different customers sharing that single IP. Tracking those ports is technically how an upstream provider can differentiate between two households on the same address.

The reality right now is that traditional IMAP/SMTP server logging often only captures the incoming connection's IPv4 address before processing authentication. Because we are one of the largest email providers in the country, we tend to lean heavily toward aggressive, blanket IP blocks to mitigate massive inbound spam spikes, even though it may cause "collateral damage" for CGNAT users.

Posting and commenting on our forums is great place to start! We have backend teams that track trends, including this kind of feedback. So we truly appreciate you taking the time, and hopefully things will develop in a way that benefit you (and others)!

Sometimes, the automated IP block triggers because Outlook is trying to authenticate using basic standard password verification over an IP that the system views as high-risk. Ensure Modern Authentication (OAuth2) is fully enabled for the account. Go to the Xfinity account settings online, ensure turn on Third-Party Access is toggled, and if available, enforce Multi-Factor Authentication. When Outlook authenticates via OAuth2, it passes a secure, pre-verified token rather than a raw username/password string. Our security filters are occasionally more lenient with token-based OAuth connections coming from flagged IPs than they are with basic standard login attempts.

If BAM ISP cannot provide a unique public IP, and our automated block keeps recurring, a seamless background workaround can ensure no messages are missed in Outlook. Log into the web portal at connect.xfinity.com, go to Settings (Gear Icon) > Mail > Auto-Forward, set up a rule to forward a copy of all incoming mail to a secondary email address that handles CGNAT perfectly (such as a free Gmail or Outlook.com account), and add that secondary account to the Outlook client. This allows reading all @comcast.net emails instantly in Outlook without relying on the comcast IMAP server to download them. When needing to reply, simply switch the "From" drop-down in Outlook to the Comcast account (which uses the SMTP server, a process that sometimes bypasses the strict IMAP incoming block).

Hopefully, we've shared some things that help in the meantime. Don't forget, you can always create your own post if any other questions or concerns come up, and it'll always be our pleasure to do what we can to help :)