Mail app not accepting new iCloud email account

Solution #2 - establishing an iCloud email account on a desktop Mac through the Mail application.

Note: this solution is specific and not for set up on a mobile device or for browser based mail access.

Automatic
Under OS10.11 this process is automatic. On the Mac go to System Preferences / iCloud - sign in - then check the Mail entry in linked services. Mail application is automatically configured.

The issue I had is that the Apple automatic set up uses the primary 3rd party email associated with the Apple ID, not the iCloud email I wanted to use. You are not given a choice during auto set up. After set up, you can go in to Mail / Preferences / Accounts to see the details, but you cannot change the account because several fields are greyed out.

Manual
In order to set up your iCloud email i.e. joebloggs@icloud.com in the MAIL application on a desktop Mac, rather than the third party email used by the Apple ID, you have to do it manually.

Part (1). This official article provides the incoming / outgoing server details, ports etc. Mail server settings for iCloud email clients - Apple Podrška

Note: when setting up the new account in Mail application, don't choose iCloud from the list of providers - this will ask you to log in with your Apple ID and you are back to square one with the 3rd party email address. Choose OTHER and follow the onscreen instructions.

Part (2) In my case (under OS 10.11.6), the account set up did not fill in incoming / outgoing server address fields so I input those manually from the article in Part (1) above.

Part (3) In my case outgoing server connected fine, incoming server failed on verification (username and password for the iCloud email account). From reading up, this is possibly due to two factor verification at the Apple side which is not flagged within the Mail application process... it just fails to connect. Connection doctor (in Mail app) identified failure was login / password.

Part (4) Apple provides an extension to Apple ID security for 3rd party applications... an app specific password. Log n to Apple ID, scroll down to security, add application password - you can have up to 25. I now went back to Mail application on the Mac locally, created a new manual account as above (1) to (3) and substituted the app specific password for my iCloud / Apple ID password during set up.

It worked on both incoming and outgoing servers.

***

I can now access my new iCloud email either by a web browser on my travels or via Mail application on my primary desktop Mac running OS 10.11.6. Both sync flawlessly.

Hope this helps someone in future .

Solution: required Apple Support.

You cannot use the iCloud.com email as your primary email address for Apple ID - period. An independent, third party email is required (as the login), in case the Apple ID / iCloud is compromised. In affect the iCloud.com email is only an alias on the Apple ID even though you can use it to sign in (instead of the 3rd party email).

I can see the logic of this from an access / security point of view but a simple message on screen at the point of EDIT (or during iCloud set up) to this affect would have saved me 4 hours of trying / searching the web for answers. Apple support had the answer in 10 seconds... so obviously it is a clear part of the process to them.

And another nugget... before you change the primary email / login, all devices that use the Apple ID must be signed out or they may become locked. Again, logical, but it would be useful to give people a flag to this affect during the process of changing the ID, surely. How many people are going to think... "I better sign out of my 2 iPads, iPhone and the Mac at work first"?

And this doesn't cure my local MAIL app problem. It's still going to propagate adding a new account with a 3rd party email (it uses the Apple ID login) not my iCloud mail account. Oh dear, never mind.