... client connects to server and negotiates a TLS protection layer ... C: C01 CAPABILITY S: * CAPABILITY IMAP4rev2 AUTH=PLAIN AUTH=EXTERNAL S: C01 OK Completed C: A01 AUTHENTICATE EXTERNAL = S: A01 OK Success (tls protection)