Use a Yahoo app password, not the regular password
An app password is a separate credential created in Yahoo account security for use by a mail client. It can be revoked without replacing the password used to sign in to Yahoo on the web.
Create the credential while signed in to the correct Yahoo account, label it for Unibox, and enter it only in the guided Yahoo setup. Unibox stores the saved value in macOS Keychain.
Gather both IMAP and SMTP settings
Generic email needs two connections. IMAP reads and organizes messages; SMTP sends them. Your host should provide the server names, ports, username format, and encryption requirements for both.
- Incoming IMAP hostname and port.
- Outgoing SMTP hostname and port.
- Whether each connection requires TLS or STARTTLS.
- The exact username, often the complete email address.
- A provider app password when ordinary passwords are not accepted.
Do not guess around a certificate warning
A certificate mismatch or untrusted certificate is not a normal password problem. Recheck the host name against the provider's documentation and ask the email host for the correct secure endpoint. Do not disable certificate validation to make the connection succeed.
Likewise, avoid selecting an unencrypted connection just because it is available. Email credentials and message content should travel over a provider-supported encrypted connection.
Verify folders after the first connection
Providers use different names for Sent, Drafts, Archive, Spam, and Trash. After the first sync, confirm that sent messages appear in the provider's real Sent folder and that trash and spam actions go to the expected destinations.
If the host exposes several similar folders, use the provider's webmail as the source of truth and compare a test action from the Mac client.
Keep credentials private when asking for help
A support request should include the provider name, server host names, ports, encryption choices, and exact error text. It should never include an app password, ordinary password, API key, or a screenshot that exposes one.
Questions about this workflow
Why does Yahoo Mail need an app password?
Yahoo may require a separate app-specific password for third-party mail clients. It can be revoked independently from the main Yahoo password.
What is the difference between IMAP and SMTP?
IMAP reads and organizes mailbox content. SMTP sends outgoing messages. A complete generic account setup normally needs working settings for both.
Should I accept an invalid mail-server certificate?
No. Verify the server name and secure settings with the provider. A certificate mismatch can indicate a configuration problem or an unsafe connection.
Sources and further reading
Provider behavior and security guidance in this article is grounded in primary documentation: