Thunderbird Community Forum

I have & use the T-Bird app on my desktop pc. I have it set up with a password for access when I click on the system tray icon to launch the program. It then asks me for my password, all good, yes, just as needed for security. But, as with other apps, I would like a second layer of security such as 2FA. I have an authenticator app on mobile phone for this additional layer of security for all my other apps, works great. I can't find this second layer of security on the T-Bird app, is it available, if so, where is it? Thank you.

Hello, I have the following problem: Bitdefender keeps sending me notifications about Thunderbird emails. I have already contacted their support team and they advised me to tell you that Bitdefender correctly detects and removes infected attachments in the temporary folder; However, some emails do not seem to be deleted or synchronized correctly with Gmail, causing repeated notifications. Can you please help me?

I have a problem with thunderbird. I can't fetch the certificate in my account settings, it seems it's not security approved. Normally when I type "fetch certificate" a window pops up asking me to confirm a security exception, but this function no longer works on thunderbird. Is there another way I can confirm the security exception?

Payment declined for Thunderbird: Free Your Inbox subscription

Google Play Your subscription will be cancelled UPDATE PAYMENT Hi k,

Your payment from Visa-xxxx was declined.

If you don't update your payment method, you'll lose all of the benefits provided by Valued Monthly Contribution (Thunderbird: Free Your Inbox). These benefits include the following:

   A monthly, voluntary contribution
   Enable us to build new features
   Help us take meaningful steps forward
   Contributions are not tax-deductible

To keep these benefits, you'll need to keep your subscription active. Update your payment method or use a different one.

SUMMARY Amount Due $10.73 Fix by Dec 26, 2025 UPDATE PAYMENT

Learn more

Thanks, The Google Play team See your Google Play Order History. View the Google Play Refund Policy and the Terms of Service.

Google LLC, 1600 Amphitheatre Pkwy, Mountain View, CA, 94043, United States

Hello,

I have saved message templates that I use. Each one also has a footer (which I save as an .html file).

When I use this template to send a message, the image in the footer doesn't load and I get the message: Thunderbird has blocked the file from loading in this message.

When I click UNBLOCK, nothing happens. The image still doesn't get added. It's a very small image from my footer/signature. 'When I compose a new message, I don't have this problem' – the image in the footer loads and is sent to the recipient. This problem occurs when I try to send a message saved in the templates. There's no way to "unblock the image" and send it.

Mozilla Thunderbird Email wants to access your Google Account

This will allow Mozilla Thunderbird Email to:

Read, compose, send, and permanently delete all your email from Gmail

See, edit, download, and permanently delete your contacts

See, edit, share, and permanently delete all the calendars you can access using Google Calendar

Mzila Fire Fox that has me perplexed. There is a line that reads, In part….. https://accounts.google.com/signin/oauth/legacy/consent? uthuser=0&part=AJi8hAO27SA1jp0smbnYjSww31z06r6NnelkFAEXAX1pRgQq_2fkoC2lI-Rs0mf3jYCnMSdoG2Gr9V6XDkmWlQydzTYpDy4U-OREnYRGiXK0wIrp32BEL1sC1QyzBm-ZzUFPi6sQw3DCq7hh-HL7ZEAw9QDzw22rmwU7DPjP1nMpdWenxE6fE4LwyjUnAobeE3RPLIWik4O3f5U4lSI1Hwj0AiWBCsLD-

Hello. I'm trying to set up automatic config for DAV contacts and calendars located on my Nextcloud server. I've followed this doc: https://wiki.mozilla.org/Thunderbird:Autoconfiguration:ConfigFileFormat and I've managed to get at least the calendar to connect, but with one unfortunate condition: I have to open Thunderbird's about:config and set browser.opaqueResponseBlocking and browser.opaqueResponseBlocking.javascriptValidator to false.

Otherwise the request to DAV gets blocked by Thunderbird for some reason. Here is some information about my current setup: IMAP and SMTP servers are located at mail.mydomain.com, and email addresses look like user@mydomain.com. The webserver serving config-v1.1.xml is located there too, but it's behind a reverse proxy, which also proxies nextcloud.mydomain.com. When I add a new account to Thunderbird, it requests mydomain.com/.well-known/autoconfig/mail/config-v1.1.xml, so I've added a redirection rule on the reverse proxy which sends it to mail.mydomain.com and it seems to be working ok. I've added this section to the xml file:

   <addressBook type="carddav">
     <username>%EMAILLOCALPART%</username>
     <authentication>http-basic</authentication>
     <serverURL>https://nextcloud.mydomain.com/remote.php/dav/</serverURL>
   </addressBook>

   <calendar type="caldav">
     <username>%EMAILLOCALPART%</username>
     <authentication>http-basic</authentication>
     <serverURL>https://nextcloud.mydomain.com/remote.php/dav/</serverURL>
   </calendar>

(username on the Nextcloud matches the local part of the email address)

But looking at Network tab of the dev console I can still see that it's trying to get well-known dav from my top level domain. So I add redirection from there too: mydomain.com/.well-known/caldav -> https://nextcloud.mydomain.com mydomain.com/.well-known/carddav -> https://nextcloud.mydomain.com

Finally I can see the request is made to correct address: 207 PROPFIND nextcloud.mydomain.com/remote.php/dav But the icon shows it's blocked and there is a message in the JS console: The resource at “https://nextcloud.mydomain.com/remote.php/dav” was blocked by OpaqueResponseBlocking. Reason: “nosniff is true and mimeType is an opaque-blocklisted MIME type or its essence is 'text/plain'”.

I've found 2 settings I can switch off: browser.opaqueResponseBlocking = false browser.opaqueResponseBlocking.javascriptValidator = false And after that, viola - I can see my calendars showing up upon adding the account (but not contacts, I think it's a separate issue and I have to check everything).

My question is: is it possible to set this up without manually switching Thunderbird options on every machine? Some HTTP headers, perhaps?

I just installed thunderbird on a new install of windows 11 25h2 and added my email account. When I click on a message a yellow banner appears at the top of the message. Previously there was a options button I could click that would allow showing the remote content. There is no longer a options button and I cannot get thunderbird to show remote content.

Hi Folks,

I want to seek opinion on how to manage the virus detected in emails (or its attachments) through Kaspersky Anti Virus.

I have large no of emails in TB stored in mbox format. Around 30GB in Inbox and another 5GB in Sent, etc. I also use Kaspersky Internet Security which has anti-virus also active.

Now my anti virus detects some infected emails. How to clean the infected virus emails / attachments.

Question: 1) When using mbox file on TB, is Kaspersky capable to delete ONLY a single specific infected file from the entire mbox data without any corruption of mail data? 2) If not, how to setup the anti-virus to automatically clean, disinfect and delete/quanrantine individual mail. ?

3) Is MailDir a better way to save emails in profile and use anti-virus. There is a warning on Maildir saying its still not settled and may have bugs. Is that true even today ?

Thanks & Regards, Tejas

Hallo, bei mir kommt immer wieder das angehängte pop-up. Wie kann ich die Abfrage dauerhaft entfernen. Ich hatte mal ocloud aber schon lange nicht mehr also wird das nicht gebraucht Bitte um Hilfe

LG Manfred

Hallo,

(new information at the end)

in an effort to understand why one s/mime signed message I received could not be verified by Thunderbird (140.3.0esr (64-bit) on Ubuntu 24.04.3 LTS) (error 1041, "unknown problems with this digital signature"), but by all other clients I and others could check (including cli tools openssl, cmsutil), I did a few tests using my own certificate (using rsaEncryption, SHA256).

Inital observation: Messages signed with "openssl smime -sign -in msg.txt -to <email> -from <my-email> -subject test -signer mycert.pem -inkey mykey.pem -out signed.eml" and opened in Thunderbird showed error 1041. Any modifiers like -crlfeol, -text, -binary, ... did not make a difference.

Omitting signed attributes (-noattr) however helped. The signature was verified.

Further investigations now showed that the reason for that is a mismatch of the signing time in the signed attributes block with the RFC 5322 date in the header (or a missing date, which is the reason, the openssl smime output is rejected). If there is no match, Thunderbird shows a 1041 error (unknown problems with the signature).

However, I'm wondering whether such a test a reasonable. The standards don’t instruct MUAs to compare signingTime to the RFC 5322 Date. Flagging a mismatch is not required by spec and in my opinion adds little to no security value. The RFC date header can be easily modified and the signing time is openly readable.

Does anyone knows why it has been decided to test that?

02 Oct. 2025

Recently, some automatic updates were made to my Dell desktop. I assume they were updates to the Windows 11 OS.

The updates also caused some changes to my Thunderbird e-mails. The incoming e-mails are formatted differently. I used to get a message, saying that "remote content" in some incoming e-mails had been blocked. I was given the option to show remote content in the incoming e-mail. Now, I no longer have the option to "show remote content".

Please tell me how I can recover the option to "show remote content" on incoming e-mails.

Thank you.

Connie Yanicka

cyanicka46@gmail.com

So I keep getting this pop-up message from Norton, "Not seeing new emails in your email app?" Everything seems to work appropriately in Thunderbird. I'm getting new emails as I always have. The problem is as long as Thunderbird is open Norton keeps popping this stupid thing up every 10 or so minutes. Has anyone had this? Have you found a way to get Norton to realize everything is fine and stop popping up? It's like playing a game of wack a mole all day.

Hi, I'm installing Thunderbird, and it displays "Mozilla Thunderbird Email wants to access your Google Account", and then "This will allow Mozilla Thunderbird Email to:" and "... permanently delete all your email from Gmail" and "See, edit, share and permanently delete all the calendars that you can access using Google Calendar", DOES THIS MEAN that Thunderbird WILL "DELETE ALL my email from Gmail" as soon as I click ALLOW ??? Silly question, I'm sure, but I don't like the wording, and the possible implication. Thanks, AK

One of my email friend's email has been hacked into. I had a request by him to send some money through Amazon, I fell for it. I found out that his identity had been clone from a Facebook friend.

Happily, I got a refund from Amazon, but has my email been compromised or hacked into also?

Hi our Kaspersky detected objects but unfortunately our antivirus can't delete all the detected. I try to uninstall the thunderbird but still unable to delete the virus's message.

Hope get the assist for your team.

thank you

Thunderbird open when I skip password prompt for more than 4 times. I password protect thunderbird & when I try to open it's prompted for password BUT when I skip it by click on X for more than 4 times Thunderbird opened & I'm able to mail & read mail. It's a security bug so please fix this.

Setting up Thunderbird for some non-technical users that receive messages with tracking images, scripts etc. We would like to prevent users from enabling/allowing remote content; in other words, we would like Thunderbird not to display the “Preferences” button or the whole “To protect your privacy, Thunderbird has blocked (…)” bar, like it is visible in Remote Content in Messages. Is it doable in current Thunderbird versions?

Setting permissions.default.image=2 seems to actually block remote images even if user tries to allow them, which is good but confusing. It also breaks images in the build-in web browser, it is unintended. We are unsure if the setting applies to all kinds of remote content.