Shortest answer:
You do not have correct settings. You are not unique here, you are certainly not going to get help from an ISP as they’re next to useless in this regard, and you’re either heading toward deeper understanding of mail and mail authenticarion and sertings, or toward enlisting some (trusted) help knowledgeable in mail and mail authentication and secondarily in the macOS mail client. The local Apple Store, or Apple Support, maybe.
Passwords and reset protocols:
Remembering passwords and not losing our tokens is where we are. Which means using keychain or another password manager, and dealing with contacting support folks when passwords are lost or forgotten or re-used or otherwise exposed. And part of that is getting the credentials entered, and getting the correct server sertings entered in the case of mail, for both sets of credentials associated wih the connection.
Long answer:
Implementing a “forgotten password” protocol would involve modifications to a large chunk of the Internet; to mail servers and to each of the ISP authentication implementations, and to whatever 2-factor authentication scheme and whatever lost-token-card scheme or other two-factor or multi-factor scheme that an increasing number of folks are using to,secure access, and modifications to whatever each might use for authentication.
The design of that reset protocol is also going to a whole lot of discussions and a whole lot of stakeholders debating and then a whole lot of coding and testing, and then software upgrades, and across a whole lot of very different computer systems.
Because no client is going to want three or four reset protocols, much less thousands or millions of unique and mail-provider-specific reset schemes.
And a whole lot of revewers and testing folks and the usual sorts of nefarious folks and narional,security entities then try to spoof or break the new password reset scheme.
Not a small project.
Whatever authentication scheme is chosen here will still be subjected to folks lying and scamming to gain access to your email accounts, or to your phone numbers, too.
Here? What to do with a forgotten mail password? Contact the ISP and authenticate with them and then ask them to change the password, if they don’t provide web access and a reset mechanism; a fall-back contact email address or additional security questions or a phone number or a token card, or whatever the particular ISP has chosen for secondary authentication. Then reset the password in the read/receive path (POP or IMAP) and then in the sending path (SMTP or ESMTP).
Here? What to do with all the passwords we’re accumulating? Use a password manager. There are add-ons for various configurations, and Apple provides Keychain with macOS and iOS. Other operating systems usually have password managers, though not all do. Use the password manager to store the password. Or in the case of Keychain and some others, use the keychain to store secure and encrypted notes to yourself, containing (small) amounts of sensitive information.
And there are folks debating what to do with those that have died, and their passwords, and folks that are no longer legally competent to maintain passwords, what happens with warrants and government access and how that might work (and without defeating all client security) and how to maintain secondary authentication for recovery without opening up customers to social engineering (scams and cons, whether directed at the users or at the companies and their agents in control of the passwords), etc.
BTW...
There’s a booming business—business, as there’s lots of money to be had—in using password data from server breaches being used to try to breach other servers. To use credentials from one site to try to access others. This is really popular among the scammers right now, and this is why re-using passwords can be trouble. Not because you,forget your password, but because some server doesn’t store your password securely and doesn’t use a modern password hash, and that server than gets breadhed and exposes thousands or millions of usernames and passwords. And those then get tested everywhere else, against other services.
What happens with big Internet-wide projects?
We’ve been working on an Internet-wide upgrade to increase the available number of hosts—migrating the IP address space (to IPv6)—for ~twenty years, and we’re nowhere near done with that. These things can take decades.
A password reset scheme for mail—or more generally—can still be an interesting suggestion to make to Apple, though.