slow authentication challenge from [pop|imap].ge.xfinity.com

[antgaucho]

I've had pop.ge.xfinity.com and imap.ge.xfinity.com configured as incoming mail servers on local mail clients for years, and use them to check mail several times nearly every day.  About a week ago it took over half an hour for each server to respond to initial authentication request.  Once authenticated, headers, bodies, attachments as appropriate were transferred at a respectalbe speed.  This happened a couple of times in the same day, then not again until today.  A little earlier today I had to wait >3 minutes for the authentication response.  So I decided to time my next login.  While typing this post, the server finally responded to an authentication request I sent 19m53.906s earlier.  I think my internet connection is stable and fast.  Good luck.

[ComcastCSAEmail]

here are the guidelines for the server settings,
IMAP: https://www.xfinity.com/support/articles/update-your-xfinity-email-settings
POP: https://www.xfinity.com/support/articles/update-pop3-110-995

see if using the recommended settings improves your experience.

[antgaucho · Accepted solution]

[my own workaround, posted in case it applies to someone whose search led here.]
No, thanks for the idea but the "recommended settings" did not make a difference.  BTW they specify "pop3.comcast.net" as pop server but "imap.ge.xfinity.com" is still the canonical name (CNAME) returned for pop3.comcast.net by DNS (domain name service) tools such as dig, host, or nslookup .  That's not a typo, "imap" is actually a substring of the canonical pop server name.  There was a fun period around the time of the great port change foulup of 2018 when imap.ge.xfinity.com worked and the recommended servername did not--that is why my settings were pointed to the former.  This new problem I posted is apparently related to the configuration of Comcast's certificates.  My best guess so far is that a certificate failure appeared on a comcast server recently, and that my email client is fussy about that, but only fussy enough to go through some lengthy renegotiation--every time--eventually allowing the authentication step to proceed.  I finally allowed a certificate exception and the behavior is back to normal, so I'm going to leave it to someone getting paid (by us), to figure out the rest.
'hope this helps