Configuring Apple Mail for POP using Kerberos

Before you begin

To use Kerberos authentication you must configure your Mac to use Stanford's Kerberos realm.

1. Make sure the Kerberos Configuration Utility for Mac is installed on your computer. To verify, go to your Applications folder and navigate to Stanford > KCT > Stanford Kerberos Login.
2. Log in to Stanford Kerberos using you SUNet ID and password.

There are a couple of  ways to log in to Kerberos.

• A convenient way to initiate a Kerberos login is via Stanford Desktop Tools (SDT). Right-click (or control+click) the SDT icon   in the dock and then click Authenticate to Kerberos.
• Navigate to Applications >Stanford > KCT > Stanford Kerberos Login and open Stanford Kerberos Login. (You may want to drag the Stanford Kerberos Login program to the dock for easier access.)

Your Kerberos authentication is valid for 25 hours, so you need to log in to Kerberos every day to send and receive mail. If you don't log in via one of the methods above, you will not be prompted for a password.

Starting the configuration wizard

If you have not previously configured an account in Mail the configuration wizard will launch automatically the first time you open Mail.

Otherwise you'll need to start the wizard by doing to following:

1. On the Mail menu, click Preferences.
2. Click Accounts in the toolbar.
3. At the bottom of the window click the plus sign.

Using the configuration wizard

1. Enter the following information into the Welcome to Mail window:
   • Full Name: the name you want displayed on your outgoing mail
   • Email Address: your @stanford email address
   • Password: leave blank
   Click Continue when done.
   
   
   
   
2. If a message saying that the Exchange server autodiscover function failed is displayed, click Continue.
   
   
   
   
3. Enter the following information in the Incoming Mail Server window:
   • Account Type: POP
   • Description: Stanford
   • Incoming Mail Server: your SUNetID.pobox.stanford.edu
   • User Name: your SUNetID
   • Password: leave blank
   Click Continue when done.
   
   
   
   
4. Enter the following information into the Incoming Mail Security window (Note: Your may not be presented with this window):
   • Use Secure Socket Layer (SSL): checked
   • Authentication: Kerberos Version 5 (GSSAPI)
   Click Continue when done.
   
   
   
   
5. Enter the following information into the Outgoing Mail Server window:
   
   • Description: smtp.stanford.edu
   • Outgoing Mail Server: smtp.stanford.edu
   • Use only this server: checked
   • Use Authentication: checked
   • User Name: your SUNetID
   • Password: leave blank
   Click Continue when done.
   
   
   
   
6. Enter the following information into the Outgoing Mail Security window (Note: You may not be presented with this window):
   • Use Secure Sockets Layer (SSL): checked
   • Authentication: Kerberos Version 5 (GSSAPI)
   Click Continue when done.
   
   
   
   
7. In the Account Summary window, check Take account online and then click Create.
   
   
   
   

Adjusting configuration

You will now go to the preferences to verify and correct as necessary the settings the wizard created.

1. On the Mail menu, click Preferences and then click the Accounts on the toolbar. Select the Stanford account and verify the following settings in the Account Information tab:
   • Enable this account: checked
   • Email Address: your @stanford email address
   • Full Name: the name you want displayed on your outgoing mail
   • Incoming Mail Server: your SUNetID.pobox.stanford.edu
   • User Name: your SUNetID
   • Password: leave blank
     
     
   
   
   
2. Click the drop down menu for Outgoing Mail Server (SMTP) and click Edit SMTP Server List
   
   
   
   
3. In the outgoing server list window, select the entry for smtp.stanford.edu and verify the following is entered under the Account Information tab:
   
   • Server Name: smtp.stanford.edu
   
   
   
4. Click the Advanced tab and verify the following settings:
   
   • Use custom port: 465
   • Use Secure Sockets Layer (SSL): checked
   • Authentication: Kerberos Version 5 (GSSAPI)
   • User Name: your SUNetID
   • Password: leave blank
   
   
   
5. Click OK to close the outgoing server list window
   
   
6. Click the Advanced tab and verify the following settings:
   
   • Include when automatically checking for new mail: checked
   • Remove Copy From Server After Retrieving A Message: checked, After One Week (recommended)
   • Port: 995
   • User Secure Sockets Layer (SSL): checked
   • Authentication: Kerberos Version 5 (GSSAPI)
     
     
   
   
   
7. Click the Junk Mail tab in the toolbar.
   
   
8. If promted to save your changes, click Save.
   
   
   
   
9. Uncheck the Enable Junk Mail Filtering setting.
   
   
   
   Note: Rather than use Mail's internal junk filtering tools which will require users to train it, IT Services recommends relying on the anti-spam filter we run on the mail server.
   
   
10. Close the Preferences window.

Additional information and configuration

• To set up Apple Mail to work with Stanford's spam tagging system, see Creating a Spam Filter in OS X Mail.
  
  
• See Configuring Apple Mail for Directory Access for instructions on how to address a message with the query results from Stanford's LDAP directory. LDAP searches access the same information that is available from the StanfordWho web site.