If your mailbox isn’t Gmail or Microsoft 365, IMAP is how software gets at your invoices — whether you use iCloud Mail, Fastmail or a German provider such as GMX, WEB.DE, T-Online, IONOS or STRATO. You need three things: the provider’s IMAP server, IMAP access switched on, and the right password, which at many providers is not the one you sign in with. Below are the settings, checked against each provider’s official help pages in September 2026, the exact steps for app passwords, and the mistakes that usually break the connection.
Why IMAP is the way in for every other mailbox
With IMAP, messages stay on the server, and every device and app sees the same state: read, unread or deleted. With POP3, messages are downloaded to one device — and, as Telekom’s help pages put it, once downloaded they are only available on that device.
For bookkeeping, that decides everything: a tool that collects invoices must read your mailbox alongside your phone and desktop app without taking anything away — and reach every folder, including archive and spam. Only IMAP does that.
Gmail and Microsoft 365 have their own sign-in based connections, covered in our guides to Gmail and Outlook and Microsoft 365. Everything else goes through IMAP. iCloud Mail doesn’t support POP at all.
IMAP settings for iCloud, Fastmail, GMX, IONOS and more
Every value comes from the provider’s own help page, linked in the first column (the German providers’ pages are in German). A dash means the official guide lists no separate step.
| Provider | IMAP server | Port and encryption | Turn on IMAP first? | Which password? |
|---|---|---|---|---|
| iCloud Mail | imap.mail.me.com | 993 (SSL) | – | Always an app-specific password |
| Fastmail | imap.fastmail.com | 993 (SSL/TLS, not STARTTLS) | – | Always an app password |
| GMX (Germany) | imap.gmx.net | 993 (SSL/TLS) or 143 (STARTTLS) | Yes, off by default | With two-factor authentication: an app-specific password |
| WEB.DE | imap.web.de | 993 (SSL/TLS) or 143 (STARTTLS) | Yes, off by default | With two-factor authentication: an app-specific password |
| Telekom (T-Online, Magenta) | secureimap.t-online.de | 993 (SSL) | – | A separate password for mail programs |
| IONOS (Germany) | imap.ionos.de | 993 (SSL/TLS) | – | The password of that email address; each address has its own |
| STRATO | imap.strato.de | 993 (SSL/TLS) | – | The email password set for that address |
| Posteo | posteo.de | 993 (SSL/TLS) or 143 (STARTTLS) | – | An app password, as Posteo’s setup guide suggests |
| mailbox.org | imap.mailbox.org | 993 (SSL/TLS) | – | With two-factor authentication: an app password |
The username is your full email address at Fastmail, IONOS, STRATO, Posteo and mailbox.org. At iCloud it’s usually just the part before the @ — if that fails, Apple suggests the full address.
Step by step: turn on IMAP and create an app password
Here’s what each provider requires before a tool can read your mailbox.
iCloud Mail
Apple requires an app-specific password for third-party mail apps, and your Apple Account needs two-factor authentication for that. Apple’s steps:
- Sign in at account.apple.com.
- In the Sign-In and Security section, select App-Specific Passwords.
- Choose Generate an app-specific password and follow the steps on screen.
- Paste the password into the tool’s password field.
Whenever you change or reset your main Apple Account password, Apple revokes all app-specific passwords — every connected tool then needs a new one.
Fastmail
Fastmail doesn’t accept your regular password over IMAP at all. In the web interface, go to Settings → Privacy & Security, find the Connected apps & API tokens section, click Manage app passwords and access and then New app password. You pick a name and choose which data the password can access (Fastmail help). One catch: Fastmail’s Basic plans don’t include IMAP access.
GMX and WEB.DE
Both ship with POP3/IMAP access switched off, and the menus are identical; labels are German, with translations in brackets (GMX guide, German):
- Sign in on a computer at gmx.net or web.de.
- Click the icon with your initials in the top menu bar, then E-Mail-Einstellungen (email settings).
- Under E-Mail empfangen (receiving email), choose POP3/IMAP.
- Under POP3-/IMAP-Abruf, set the slider to POP3- und IMAP-Zugriff erlauben (allow POP3 and IMAP access).
- Complete the security check by sliding the two symbols on top of each other.
If you use two-factor authentication, you also need an app-specific password: initials → Account verwalten (manage account) → Login & Sicherheit → Anwendungsspezifische Passwörter verwalten → Neues Anwendungsspezifisches Passwort erstellen. Both help centers add that after turning on two-factor authentication you may have to switch IMAP access on again.
Telekom, IONOS, STRATO, Posteo and mailbox.org
- Telekom (T-Online, Magenta): mail apps need a separate “Passwort für E-Mail-Programme” (password for mail programs), not your Telekom login. Set it in the Kundencenter under Profil verwalten › Login-Daten › Weitere Passwörter. Telekom recommends that it differs from your login password.
- IONOS and STRATO: their help pages mention no separate IMAP switch. Sign in with your full address and that mailbox’s own password — at IONOS, every address has its own.
- Posteo: optional app passwords under Einstellungen → Mein Konto → Passwort und Sicherheit, then Anwendungs-Passwort erstellen.
- mailbox.org: once two-factor authentication is on, external programs can no longer use your normal password and need an app password.
Rules, forwarding or IMAP: three ways compared
There are three ways to get invoices out of a mailbox, and only one of them gives a tool your password.
Server-side rules. At GMX and WEB.DE, rules live under your initials → E-Mail-Einstellungen → Postfach organisieren → Filterregeln, with the action Verschiebe in Ordner (move to folder). GMX offers conditions such as sender, recipient (the To field only), subject and size — but none for attachments, so you filter by a supplier’s address or a subject word such as “Rechnung” (invoice).
Forwarding. GMX rules can forward matching mail (Weiterleiten an); WEB.DE rules can’t, and WEB.DE only forwards the whole mailbox, to up to two addresses. Either way, forwarding starts once the target address confirms an activation link sent by email.
| Approach | How it works | Strengths | Limits |
|---|---|---|---|
| Manual download | Search the mailbox once a month and save the PDFs | No setup, full control | Costs time every month; invoices in spam or behind download links slip through |
| Rules and forwarding | The mail server sorts or forwards invoices as they arrive | Runs on its own once set up | Every new supplier needs a rule; forwarding only covers new mail (and the whole mailbox at WEB.DE); invoices sent as links stay links |
| IMAP connection | A tool reads the mailbox directly | Reaches every folder and older mail; no rules to maintain | Needs credentials, ideally a dedicated app password; the tool must be trustworthy |
Invoices sent only as a link to your customer account are a special case that no rule can fix — see what to do when an invoice is only a download link.
Security: one password per tool
IMAP credentials open the whole mailbox. Three rules keep the risk small:
- One app password per tool. Wherever your provider offers them — iCloud, Fastmail, GMX, WEB.DE, Posteo, mailbox.org — create a separate password for each tool and name it after the tool. As Posteo notes, if a device is lost or compromised, you then revoke just that one access instead of changing your mailbox password everywhere.
- Revoke it when you stop using a tool. Delete the app password where you created it — at Apple via the remove button or Revoke All, at Fastmail via Remove.
- Never reuse your main sign-in password. It usually protects more than mail — billing, contracts, cloud storage.
At IONOS and STRATO, the address’s own password is the key to the mailbox, so use it nowhere else. Cleaner still: a dedicated address such as invoices@yourcompany.com that only receives invoices, so a tool sees nothing else — see how to set up an invoice email address.
How belege.ai connects an IMAP mailbox
belege.ai, an AI agent for businesses in Germany, treats your bank transactions as a to-do list and finds the matching invoice for each payment — among other places, in your connected mailboxes. You connect an IMAP mailbox with server, port, username and password; TLS on port 993 and STARTTLS on port 143 are supported. For many providers, such as iCloud, Fastmail, Yahoo, GMX, IONOS or STRATO, belege.ai detects the server settings automatically, and for providers such as GMX, T-Online or iCloud it points out that a separate email or app password may be needed.
- Encrypted and tested: the password is stored encrypted, and belege.ai tests the login before it uses the mailbox.
- Every folder: the agent searches all folders — inbox and archive first, spam and trash last.
- Nothing marked as read: it reads messages without marking them as read.
The agent uses the mailbox in two ways. Transaction-driven search always runs: for every open bank transaction it looks for the matching invoice, including email bodies and links. Links that lead to a login page go to its browser agent, which can sign in to many (not all) supplier portals. The proactive scan is on by default for new mailboxes and can be switched to run only for open transactions: new mail is checked daily, and an AI reviews PDF attachments and imports invoices, receipts, credit notes and payment receipts — not quotes, order confirmations, delivery notes or terms and conditions. The first run starts from the month you pick during setup, and you can change that per mailbox.
Setup details are in the handbook on connecting a mailbox (German) and under integrations. Prefer not to store a password? Forward invoices to your personal belege.ai address instead — see receipts by email.
Common mistakes and a quick checklist
The usual causes of failed connections and missing invoices:
- IMAP is switched off. GMX and WEB.DE ship with it off — and switch it off again for security if no app has used it for a long time. If a login suddenly fails, check that switch first.
- Using your web sign-in password. Many providers want an app password or a separate mail password instead — check the last column of the table.
- Invoices in spam. At GMX and WEB.DE, marking a message as “Kein Spam” (not spam) sends future mail from that sender to the inbox; you can also put the sender or domain on the allow list (Erwünscht-Liste).
- Auto-delete. GMX and WEB.DE let you set a retention time per folder, including spam and your own folders. Check via the folder’s three dots → Ordner bearbeiten → E-Mails löschen nach: that your invoice folder is set to Nie (never).
- A full mailbox. When storage is full, new mail can’t be delivered and the sender gets an error message, as IONOS explains (German). Telekom’s free Freemail and Mail S plans, for example, come with 1 GB of mailbox storage.
- POP3 in an old mail app. Messages it downloads may afterwards exist only on that device.
- A forwarding address instead of a mailbox. At IONOS, forwarding-only addresses have no password. Connect the mailbox they forward to.
Before you connect a mailbox:
- IMAP server and port noted from the table, usually 993 with SSL/TLS
- IMAP access switched on where required (GMX, WEB.DE)
- A dedicated app password created and named after the tool
- Username checked: usually the full address, at iCloud often just the part before the @
- Spam folder reviewed, important suppliers on the allow list
- Retention settings of spam and invoice folders checked
- Enough free storage in the mailbox
Retention: your mailbox is not an archive
If your business is in Germany, invoices count as accounting vouchers (Buchungsbelege). Since 1 January 2025 you keep them for eight years under Section 147(3) AO, the German Fiscal Code, and Section 14b UStG, the VAT Act — counted from the end of the calendar year in which the invoice was issued. Business letters, including business emails that aren’t vouchers, are kept for six years, and books and annual financial statements for ten. More in our glossary: retention periods (German). Outside Germany, your local rules apply.
Keep invoices you received electronically in their original format: the PDF file itself, and for an e-invoice (XRechnung or ZUGFeRD) the XML, which is the legally relevant part. A printout replaces neither — that follows from the GoBD, the German rules for electronic bookkeeping.
A mailbox makes a poor archive: retention settings delete mail, full mailboxes bounce it, and a provider switch can take your history with it. Keep invoices in a separate archive that can’t be altered — and don’t store the same invoice twice via forwarding and IMAP (see how to prevent duplicate invoices).