Configuring IMAP over SSL for a catch-all mailbox is a short procedure with a long list of ways to get it wrong. The four fields that matter are the host, the port, the encryption toggle, and the username, and most failures trace back to one of them being set to something plausible but incorrect. This walkthrough covers the exact values to use on port 993, how to verify the certificate before you commit, and why a generic SSL error on a cheap catch-all host usually means the certificate chain, not your password.

Set the host to the MX hostname, not the domain

The first field in any IMAP client is the server host. The instinct is to type the domain you registered, something like example.xyz, because that is the address you see in the mailbox. On most catch-all providers this is wrong. The correct value is the MX hostname, the actual mail server record published in DNS, which is often a subdomain such as mail.allmail.one or a provider-specific host. If you registered through AllMail, the account panel shows the MX hostname directly, and the service writes the DNS records automatically on activation, so there is no manual zone editing to cross-check against.

Getting this wrong produces one of two errors. If the bare domain resolves to a web server, the connection is refused on port 993 outright. If it resolves to nothing, the client reports an unknown host. Both look like network problems and send people chasing firewalls. Pull the MX record first, use that hostname verbatim, and the rest of the setup gets simpler.

Port 993, SSL/TLS on, full address as username

Port 993 is the implicit TLS port for IMAP. That means the TLS handshake starts immediately on connection, before any protocol greeting. Set the encryption dropdown to SSL/TLS, not STARTTLS. STARTTLS belongs on port 143 and negotiates encryption after the plaintext greeting, which is why clients that offer both will fail on 993 if you pick the wrong one. AllMail supports IMAP over SSL on 993 and also POP3 on port 110 for clients that prefer the simpler protocol.

The username is the full catch-all address, including the domain: anything@yourdomain.xyz, not just the local part. This trips people up because some hosts accept a bare username and infer the domain. Catch-all hosts cannot infer anything, since every address on the domain is valid and routed to the same mailbox. The password is whatever was set at activation. If the client offers an option to authenticate with OAuth, ignore it here; XRumer and most bulk tools only speak plain LOGIN over the encrypted channel.

Folder selection and the INBOX default

Set the folder to INBOX. XRumer polls the mailbox for activation links and confirmation messages, and those arrive in INBOX on any sane server. If the client lets you pick a folder path, leave it as the literal string INBOX in uppercase, since IMAP folder names are case-sensitive on many servers and a lowercase inbox can resolve to nothing. Some clients expose a prefix setting for folder namespaces; leave it empty unless your provider documents otherwise. Once connected, the mailbox should list INBOX and little else on a fresh catch-all account.

AllMail retains mail for 14 days, which shapes how you poll. A registration run that takes longer than two weeks between sending and reading will lose messages. catch-all email for XRumer provides further background on the subject. Point XRumer at the mailbox with a polling interval measured in minutes, not hours, and pull activation links promptly. The same retention window applies whether you read over IMAP or POP3, so switching protocols does not buy extra time.

Verify the certificate chain before blaming the password

This is where cheap catch-all hosts separate from good ones. When XRumer or any client connects to 993, it validates the server certificate against its trust store. A self-signed certificate, or a valid certificate issued for a different hostname than the one you entered, fails validation. The client then reports a generic SSL error, something like "SSL connect error" or "certificate verify failed," with no hint that the problem is the chain rather than your credentials. People reset passwords, retry, and burn an hour on a five-second fix.

Check the chain before configuring anything. From a shell, run openssl s_client -connect mail.yourhost:993 -servername mail.yourhost and read the output. You want a certificate whose subject or SAN matches the hostname exactly, issued by a public CA, with the full intermediate chain presented. If the chain is incomplete, add the intermediate or pick a provider that serves it. AllMail issues certificates for its mail hostnames and writes the DNS records on activation, so the hostname in the MX record and the certificate SAN line up by design. Test with the exact hostname string you will paste into XRumer, not a variant, because a mismatch on a single label is enough to fail.

The same check applies to POP3 on port 110 if you choose that route. Plain port 110 is unencrypted by default, and many clients offer a separate SSL toggle or a port 995 alternative. If your client insists on 110, confirm whether it wraps the session in TLS or sends credentials in the clear; for mass registration work, prefer the encrypted path and treat plaintext POP3 as a last resort.

Cost is part of the picture. A shared subdomain plan starts at $0.49 per month, and dedicated domains start at $3.59 per month for .xyz. Dedicated domains give you a clean domain reputation and a certificate that matches your own name, which matters when you run many mass registration jobs and want failures to be diagnosable rather than mysterious. AllMail offers no KYC and accepts USDT and USDC payments, so provisioning a batch of catch-all domains for XRumer takes minutes rather than an account review cycle.

Work through the fields in order: pull the MX hostname, enter it as the host, set port 993 with SSL/TLS enabled, use the full catch-all address as the username, and leave the folder as INBOX. Then run the openssl check against that exact hostname and confirm the chain is complete and the SAN matches. If the certificate verifies and authentication still fails, the problem is the password or the account state, and you can say so with confidence instead of guessing. Keep polling inside the 14-day retention window, and when a job fails, read the error as either a certificate problem or a credential problem, because on a correctly configured catch-all host it is almost never anything else.