[Solved] Postfix SASL Authentication Failure: realm changed: authentication aborted in Plesk

When enabling STARTTLS on a Plesk server running Postfix, mail clients like Mozilla Thunderbird may connect normally, while Microsoft Outlook clients repeatedly fail with authentication popups and the following mail log errors:

Environment: Plesk • Postfix with STARTTLS • Cyrus SASL Authentication

postfix/smtpd[1929]: warning: SASL authentication failure: realm changed: authentication aborted
postfix/smtpd[1929]: warning: SASL DIGEST-MD5 authentication failed: authentication failure

Root Cause & Solution

Outlook struggles with DIGEST-MD5 SASL negotiation over TLS on certain Cyrus SASL configurations. Restricting the SASL mechanism list to CRAM-MD5, PLAIN, and LOGIN resolves the negotiation conflict:

1. Edit /usr/lib64/sasl2/smtpd.conf and update mech_list:

   mech_list: CRAM-MD5 PLAIN LOGIN

2. Edit /etc/postfix/main.cf and confirm security options:

   smtpd_sasl_security_options = noanonymous

3. Restart services:

   service postfix restart
   service saslauthd restart