S—! Problem was a typo. I put in 10025 instead of 11025. If I enter 127.0.0.1 and 11025 into the client (Thunderbird), tell Avast! to watch 11025, Stunnel to watch 25 and connect to 587 all works. But still need IgnoreLocalHost=0 . Thanks for letting us know about 587; 465 didn’t work for me. So now a FAQ for doing secure scanning with Stunnel for both POP3 and SMTP.