Thunderbird issues, KfW, Windows domain + separate KDC

[Ken Hornstein]

>
>Aug  6 11:29:20 mailsrv1.company.org imap[29443]: [ID 824502
>local6.notice] badlogin: client.company.org [XXX.XX.200.50] GSSAPI
>[SASL(-1): generic failure: protocol violation: client requested
>invalid layer]
>
>======================================================================
># /etc/imapd.conf
>...
>allowplaintext: false
>force_sasl_mech: gssapi
>sasl_log_level: 4
>sasl_minimum_layer: 1

Unfortunately, the last line of your imapd.conf is very likely the problem.
sasl_minimum_layer: 1 means that your SASL connection has to at least do
integrity checking, which Thunderbird does not support.

--Ken