Thunderbird
Thunderbird is a free app for reading and sending email, managing contacts and organising calendars. It’s made by MZLA Technologies, based in the United States.
Criminals have used its name in fake downloads or scams, so get it only from thunderbird.net.
What it is
Thunderbird brings email accounts into one app. People use it to read, send, search and organise messages, manage contacts and keep calendars.
It processes your messages, contacts and calendar data on your Mac and connects to the providers you configure. It can access files you attach to messages. Mozilla says these contents are not sent to it through normal mail use. Thunderbird collects usage and technical data by default; you can turn this off.
Thunderbird is an established, open-source app with automatic updates and published security fixes. Its maker recommends downloading the Mac version from thunderbird.net. Keep it updated, as serious flaws have been found and fixed.
Who makes it
MZLA Technologies is a US software company wholly owned by the Mozilla Foundation and responsible for Thunderbird since 2020. Its legal name is MZLA Technologies Corporation. Its website is thunderbird.net.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of Thunderbird. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is org.mozilla.thunderbird or org.mozilla.thunderbirdbeta or org.mozilla.thunderbird-daily. Download it only from thunderbird.net, not from an ad or a link someone sends you.
Fakes. In October 2023, Thunderbird warned that criminals were using adverts to promote fake Thunderbird downloads containing ransomware.
What it connects to
In normal use, Thunderbird talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
aus.thunderbird.net | Checks for app updates. |
incoming-telemetry.thunderbird.net | Receives usage and technical data. |
thunderbird-settings.thunderbird.net | Fetches remote settings. |
services.addons.thunderbird.net | Fetches add-on information and search results. |
versioncheck.addons.thunderbird.net | Checks for add-on updates. |
versioncheck-bg.addons.thunderbird.net | Checks for add-on updates in the background. |
live.thunderbird.net | Opens release notes and product information. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Contacts | Makes contacts from the macOS address book available in Thunderbird. |
Security record
Problems with Thunderbird or MZLA Technologies in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| A crafted email could cause a reply or forwarded message to include content from another email without warning; this was fixed in Thunderbird 159 and 153.6. | ↗ | |
| Exchange account setup could send the entered password over an unencrypted connection, exposing it to a network attacker; this was fixed in Thunderbird 158.0.1. | ↗ | |
| A crafted HTML email could trigger unwanted downloads or load external content, with Windows credentials also at risk on Windows; this was fixed in Thunderbird 139.0.2 and 128.11.1. | ↗ | |
| An attachment disguised as a PDF could run JavaScript when opened; this was fixed in Thunderbird 128.10.1. | ↗ |
References
- Thunderbird Desktop thunderbird.net
- Thunderbird's New Home blog.thunderbird.net
- Thunderbird donation questions: organisation and location thunderbird.net
- Thunderbird Privacy Notice mozilla.org
- Thunderbird Telemetry support.mozilla.org
- Download Thunderbird thunderbird.net
- Update Thunderbird to the latest version support.mozilla.org
- Thunderbird 159.0 release notes thunderbird.net
- Mozilla Bug 1789061: release and Daily bundle identifiers bugzilla.mozilla.org
- Mozilla Bug 1864920: Beta and Daily bundle identifiers bugzilla.mozilla.org
- Mozilla Bug 1720257: macOS Contacts permission bugzilla.mozilla.org
- Thunderbird source: update server configuration raw.githubusercontent.com
- Thunderbird source: default connection settings raw.githubusercontent.com
- Mozilla Bug 1985918: telemetry and add-on connection logs bugzilla.mozilla.org
- Ransomware Alert: Are You Using A Trusted Version Of Thunderbird? blog.thunderbird.net
- Security vulnerabilities fixed in Thunderbird 159 mozilla.org
- Security vulnerabilities fixed in Thunderbird 153.6 mozilla.org
- Security vulnerabilities fixed in Thunderbird 158.0.1 mozilla.org
- Security vulnerabilities fixed in Thunderbird 139.0.2 mozilla.org
- Security vulnerabilities fixed in Thunderbird 128.10.1 mozilla.org