Thunderbird 156 adds custom OAuth support for POP3, new enterprise policies, and fixes across IMAP, POP3, attachments, OpenPGP, and calendars.

Custom OAuth, and why POP3 of all things

OAuth replaced password authentication for most major mail providers, which is a security improvement and a compatibility problem: a client needs the provider’s OAuth endpoints and a registered application identity.

Thunderbird ships configurations for the large providers. Custom OAuth lets an administrator point it at their own identity provider instead, which is what makes deployment possible in an organisation running its own SSO.

Extending that to POP3 is the part that looks odd until you consider who still uses POP3. It is not a legacy curiosity in every deployment: POP3 is still used deliberately where mail should be downloaded and removed from the server, which some organisations require for retention or data-residency reasons.

Those organisations are disproportionately the ones running their own identity providers. So custom OAuth for POP3 serves a specific and real constituency rather than a hypothetical one.

Enterprise policies

Configuration an administrator can enforce centrally rather than asking users to set.

This is the unglamorous category that decides whether software is permitted in an organisation. Without it, deployment means either a manual setup document nobody follows or a configuration that drifts across hundreds of machines. Firefox has had a policy system for years, and Thunderbird catching up removes a real objection.

The run this is part of

Thunderbird has spent several releases making itself viable at work, which is where the remaining barrier to adoption actually was.

154 added Microsoft Graph support and desktop integration. 155 improved Exchange setup. 156 extends custom OAuth and adds policies.

Corporate mail is overwhelmingly Exchange and Microsoft 365, and the historical answer for Linux users was Outlook Web in a browser tab or a fragile IMAP configuration an administrator could disable at any point. Native Exchange support with working OAuth changes that from a workaround into a supported setup.

That is a larger addressable audience than any amount of interface work would reach, and it is the right thing for the project to have prioritised.

OpenPGP

Fixes in this release. Thunderbird’s built-in OpenPGP, which replaced the Enigmail extension, is one of the few mainstream mail clients with encryption that does not require assembling anything.

Our GPG basics guide covers the key management side, which remains the hard part. The cryptography works; getting a correspondent’s key, verifying it is theirs, and keeping your own safe is where people actually give up.

flatpak update org.mozilla.Thunderbird