From 38a4715a7f64723ada3eea5a3e69a42edb96309e Mon Sep 17 00:00:00 2001
From: Peter Bieringer <pb@bieringer.de>
Date: Sun, 5 Jul 2026 12:54:57 +0200
Subject: [PATCH] imap_append_domain: make "@" mandatory and add some failsafe
 checks

---
 DOCUMENTATION.md      | 2 +-
 config                | 4 ++--
 radicale/auth/imap.py | 7 +++----
 radicale/config.py    | 2 +-
 4 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/DOCUMENTATION.md b/DOCUMENTATION.md
index 98caf814..7bfa9e72 100644
--- a/DOCUMENTATION.md
+++ b/DOCUMENTATION.md
@@ -1393,7 +1393,7 @@ Default: `tls`
 
 _(>= 3.7.6)_
 
-Append domain to login before trying IMAP connection like @domain.tld
+Append `@` + domain to login before trying IMAP connection
 
 Default: (unset)
 
diff --git a/config b/config
index fa15ef4e..2bd39383 100644
--- a/config
+++ b/config
@@ -161,8 +161,8 @@
 # Value: tls | starttls | none
 #imap_security = tls
 
-# Append domain to login before trying IMAP connection
-# Value: none | @domain.tld
+# Append '@' + domain to login before trying IMAP connection (optional)
+# Value: domain.tld
 #imap_append_domain =
 
 # OAuth2 token endpoint URL
diff --git a/radicale/auth/imap.py b/radicale/auth/imap.py
index d34d00c7..e9a1dfd4 100644
--- a/radicale/auth/imap.py
+++ b/radicale/auth/imap.py
@@ -49,7 +49,7 @@ class Auth(auth.BaseAuth):
             else:
                 logger.info("auth imap port: %d", self._port)
         self._append_domain = self.configuration.get("auth", "imap_append_domain")
-        if self._append_domain == "none":
+        if self._append_domain is None or len(self._append_domain) == 0:
             logger.info("auth imap append domain not used")
         else:
             logger.info("auth imap append domain: %s", self._append_domain)
@@ -68,10 +68,10 @@ class Auth(auth.BaseAuth):
                 connection = imaplib.IMAP4(host=self._host, port=self._port)
                 if self._security == "starttls":
                     connection.starttls(ssl.create_default_context())
-            if not self._append_domain:
+            if self._append_domain is None or len(self._append_domain) == 0:
                 imaplogin = login
             else:
-                imaplogin = login + self._append_domain
+                imaplogin = login + "@" + self._append_domain
             try:
                 if "AUTH=PLAIN" in connection.capabilities:
                     logger.debug("IMAP authentication PLAIN selected for user %r via %s:%d (security: %s)", imaplogin, self._host, self._port, self._security)
@@ -81,7 +81,6 @@ class Auth(auth.BaseAuth):
                     )
                 elif "AUTH=LOGIN" in connection.capabilities:
                     logger.debug("IMAP authentication LOGIN selected for user %r via %s:%d (security: %s)", imaplogin, self._host, self._port, self._security)
-                    print("using imaplogin: %r", imaplogin)
                     connection.login(imaplogin, password)
                 else:
                     logger.error("IMAP server is neither supporting AUTH=PLAIN or AUTH=LOGIN: %s:%d (security: %s)", self._host, self._port, self._security)
diff --git a/radicale/config.py b/radicale/config.py
index 6b2fd766..9554e4ff 100644
--- a/radicale/config.py
+++ b/radicale/config.py
@@ -442,7 +442,7 @@ DEFAULT_CONFIG_SCHEMA: types.CONFIG_SCHEMA = OrderedDict([
             "type": imap_security}),
         ("imap_append_domain", {
             "value": "",
-            "help": "Append domain to login before trying IMAP connection like @domain.tld",
+            "help": "Append '@' + domain to login before trying IMAP connection",
             "type": str}),
         ("oauth2_token_endpoint", {
             "value": "",