Inbound email stops working: "Failed to connect to email: server:pop3 … [AUTH] Authentication failed" with "StorageEncrypter: no registered Key-Provider" in the node logsIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The instance cannot authenticate against its ServiceNow-hosted POP3 mailbox, so the POP Reader job is unable to download inbound email. Notifications continue to send normally; only inbound email is affected. Messages are not lost — they remain queued on the mail server until the connection is restored. This article covers one specific cause: the application node is missing the key-provider information needed to decrypt the stored mailbox credential. If the log signature described below is not present, the cause is different and this article does not apply — see Related Links for the alternatives. Symptoms<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Inbound email is not processed. Depending on how the failure is encountered, you may see: Email Accounts → the ServiceNow POP3 account → Test Connection failsThe POP Reader scheduled job reports 0 processed on every run, or failsNo new records in sys_email with a Received directionInbound email actions do not fire Log signature Two entries appear together in the node (localhost) log. Both must be present for this article to apply. The credential-decryption failure: WARNING *** WARNING *** StorageEncrypter: no registered Key-Provider for hashKey: <hash> Followed by repeated authentication failures from the worker threads: <timestamp> (nnn) worker.N worker.N txid=<transaction id> WARNING *** WARNING *** Failed to connect to email: server:pop3, port:<port>, message:[AUTH] Authentication failed. The StorageEncrypter line is the key indicator. [AUTH] Authentication failed on its own is a generic POP3 rejection with several more common causes. Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Deployment: instances using the ServiceNow-hosted default POP3 mailboxNot applicable to: customer-managed external mailboxes (Microsoft 365, Google Workspace, on-premise Exchange, or any account configured under Email Accounts pointing at your own mail server). Those authenticate against your infrastructure, and this cause and resolution do not apply. Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Mailbox credentials are stored encrypted on the instance. Decryption requires key-provider information to be registered on each application node. When a node does not have it, the credential cannot be decrypted, so the instance presents an invalid credential to the POP3 server and the server rejects it with [AUTH] Authentication failed. The authentication failure is therefore a downstream symptom. The credential itself is not wrong — the node simply cannot read it. Before requesting reprovisioning — rule out the common causes Reprovisioning resets mailbox credentials. It will not fix any of the following, and requesting it unnecessarily adds delay. Work through these first. 1. Confirm this is the ServiceNow-hosted mailbox.Navigate to System Mailboxes → Email Accounts and open the failing account. If the server is your own mail host rather than the ServiceNow POP3 service, stop here — troubleshoot against your mail provider instead. 2. Confirm email is enabled.Check glide.email.read.active and the overall email enablement properties. Email is disabled by default on sub-production instances after provisioning and after some clones. A disabled reader produces no inbound email but not this log signature. 3. Check whether the instance was recently cloned.This is the most common trigger for inbound email breaking. If sys_properties or the email account records were carried over from the source instance, the target may be holding configuration that belongs to a different instance. Correct the configuration and exclude those tables from future clones before escalating. See KB0869194 for the same pattern affecting PDF export. 4. Confirm the log signature is actually present.If you see [AUTH] Authentication failed without a StorageEncrypter: no registered Key-Provider line, the cause is elsewhere — a credential or account-state issue, not node keying. 5. Check the account state and password field.Verify the account is Active and that the password field is populated. 6. Confirm the failure is not transient.Isolated warnings during a node restart or a maintenance window can resolve on their own. Confirm the pattern is sustained across multiple POP Reader runs. If steps 1–6 are clear and the StorageEncrypter signature is present, proceed to Resolution. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The key-provider information cannot be corrected from within the instance. The mailbox must be reprovisioned by ServiceNow. Raise an email reprovisioning request through the Now Support service catalog — see KB0540748: Requesting e-mail reprovisioning for your instance using the Now Support Service Catalog. Include the following in the request to avoid a round trip: Instance nameThe StorageEncrypter and Failed to connect to email log entries, with timestampsConfirmation that the account is the ServiceNow-hosted POP3 mailboxWhether the instance was recently cloned, and from where Reprovisioning does not interact with DNS, so no DNS backout plan is required. Invalid DKIM/SPF/DMARC affects deliverability but does not block sending or receiving. See KB2567411 for the full impact and backout assessment. After reprovisioning Run Test Connection on the email account and confirm it succeeds.Confirm the StorageEncrypter warnings have stopped.Trigger the POP Reader job manually and confirm a non-zero processed count if mail is queued.Send a test message to the instance address and confirm a record appears in sys_email.Confirm the relevant inbound email action fired. Mail queued during the outage should download on the first successful run. Depending on the volume held, expect a burst of inbound processing.