mpop 1.4.18 is released


This release fixes XOAUTH2 authentication problems and updates translations (including a new Swedish translation).

mpop 1.4.17 is released


This release adds a new configuration command eval that replaces the current configuration file line with the output of a command (similar to passwordeval, but more general).
Furthermore, a few minor problems were corrected and the documentation and translations were updated.

mpop 1.4.16 is released


This release fixes a few minor problems related to translations and the documentation.

mpop 1.4.15 is released


This release adds a new minimal POP3 server called mpopd. You can use it as a gateway between mpop and mail software such as Thunderbird that cannot use local mail boxes directly and insists on using a POP3 server.
Similarly, msmtpd (part of msmtp) can now be used as a gateway between a msmtp and mail software that insists on using an SMTP server.
So now you can have full control over incoming and outgoing mail, including all the processing and filtering with any tools you want, while still using a mail client that does not give you these options itself.
See the msmtpd and mpopd documentation for examples.

mpop 1.4.14 is released


This release fixes a potential crash (null pointer dereference) that happens when the server does not support the UIDL command. Furthermore, for configurations using libtls instead of GnuTLS, the tls_fingerprint and tls_certcheck commands were fixed.

mpop and starttls security


A recent security analysis of STARTTLS revealed many problems of STARTTLS (as opposed to immediate TLS) in mail clients and servers. The researchers published their fake mail server software that can be used for testing client software such as mpop.
I used this software to test mpop and found no problems related to STARTTLS, but I would be grateful if someone could double check this in case I missed something. Please let me know your results, I will update this news item accordingly!
I did however find a potential null-pointer dereference if the server does not support the UIDL command. This is now fixed in the git repository.

mpop 1.4.13 is released


This release adds support for SCRAM-SHA-256 authentication via libgsasl thanks to Simon Josefsson. It also updates translations.

mpop 1.4.12 is released


This release adds support for the libtls library (provided by the LibreSSL project), thanks to Nihal Jere.
This is the third TLS library supported by mpop. Use the --with-tls= option of the configure script to choose one. Here's an overview:

Furthermore, translations were updated. Thanks again to the translators at!

mpop 1.4.11 is released


This release add support for XOAUTH2 authentication, the predecessor of OAUTHBEARER that is still in use. The passwordeval command can now handle long inputs for these methods. Furthermore, translations were updated. Thanks again to the translators at!

mpop 1.4.10 is released


Portability was improved. There should be no "permission denied" errors for temporary files on Windows systems anymore.
Translations were updated. Thanks again to the translators at!

mpop with oauth2 for gmail


Christian Tenllado documented how to use msmtp with OAuth2 authentication for Gmail. The same approach should also work for mpop.

mpop 1.4.9 is released


This version updates internationalization files and includes a new serbian translation. Thanks to the translators at!

mpop 1.4.8 is released


This version includes the folowing changes:

Furthermore, the translations were updated. Thanks to all translators at!

mpop 1.4.7 is released


This minor update fixes a build problem on MinGW and synchronizes some source files with msmtp.

mpop 1.4.6 is released


This minor update fixes a build problem on Cygwin and updates the Vim syntax files.

mpop 1.4.5 is released


This version fixes OAUTHBEARER authentication, adds support for TLS client certificates via PKCS11 devices such as smart cards, and fixes a few minor bugs.

mpop 1.4.4 is released


This version adds support for the OAUTHBEARER authentication method and fixes a few minor bugs.



The git repository contains new support for the OAUTHBEARER authentication method, formerly known as XOAUTH2, a method pushed mainly by Google.
This means mpop can now use an OAuth2 token for authentication by setting auth oauthbearer in the configuration file. The token is typically passed to mpop via the passwordeval command since it changes regularly.
However, mpop does not provide a way to generate such a token. This depends on your mail provider.
Since I do not use this method myself, it would be great if you could test this feature and maybe document how to generate the necessary token for your mail provider, so that I can add examples to the documentation.
Looking forward to your feedback!

Source code moved


The source code moved to, see the updated download instructions.
The reason is that gitlab vanished from Debian stable and there is no working upgrade path to the version in Debian backports. Sorry for the inconvenience.

mpop 1.4.3 is released


This version fixes a security problem that affects version 1.4.2 (older versions are not affected): when the new default value system for tls_trust_file is used, the result of certificate verification was not properly checked.

Update 2019-02-14: The same problem in msmtp has been assigned CVE-2019-8337. This is the patch that fixes it (included in version 1.4.3).

mpop 1.4.2 is released


This version simplifies configuration:

Additionally, there are several code cleanups and updates, and updated translations by the Translation Project. Many thanks to the translators!

mpop 1.4.1 is released


This version fixes a bug that broke TLS 1.3 support.
Furthermore, translations are now handled by the Translation Project, and a new Ukrainian translation is already included in this release. Many thanks to the translators!

If you do not want to upgrade to the 1.4 series yet but you need TLS 1.3 support, you can apply this patch to mpop version 1.2.8 or 1.0.29.

mpop 1.4.0 is released


This is the first release of the new stable release series. Noteworthy changes since 1.2.8:

mpop 1.4.0rc1 is released


This is a release candidate for the upcoming 1.4.x stable release series. The following changes were made:

Using mpop with OpenSSL is discouraged, please use GnuTLS


It is recommended to use mpop with GnuTLS instead of OpenSSL. The upcoming version of mpop will not use OpenSSL automatically anymore, and if you choose it manually, you will get a warning.

The reasons for this are listed in this news entry for msmtp (mpop and msmtp use the same TLS code).

mpop 1.2.8 is released


New in this release:

mpop 1.2.7 is released


New in this release:

Project moved


After many years, this project moved from Sourceforge to a self-hosted gitlab instance:

Older news are stored in the news archive.