diff --git a/feature/autodiscovery/api/src/main/kotlin/app/k9mail/autodiscovery/api/AutoDiscoveryResult.kt b/feature/autodiscovery/api/src/main/kotlin/app/k9mail/autodiscovery/api/AutoDiscoveryResult.kt
index 4c7af9c47..515dc8292 100644
--- a/feature/autodiscovery/api/src/main/kotlin/app/k9mail/autodiscovery/api/AutoDiscoveryResult.kt
+++ b/feature/autodiscovery/api/src/main/kotlin/app/k9mail/autodiscovery/api/AutoDiscoveryResult.kt
@@ -12,6 +12,17 @@ sealed interface AutoDiscoveryResult {
     data class Settings(
         val incomingServerSettings: IncomingServerSettings,
         val outgoingServerSettings: OutgoingServerSettings,
+
+        /**
+         * Indicates whether the mail server settings lookup was using only trusted channels.
+         *
+         * `true` if the settings lookup was only using trusted channels, e.g. lookup via HTTPS where the server
+         * presented a trusted certificate. `false´ otherwise.
+         *
+         * IMPORTANT: When this value is `false`, the settings should be presented to the user and only be used after
+         * the user has given consent.
+         */
+        val isTrusted: Boolean,
     ) : AutoDiscoveryResult
 
     /**
diff --git a/feature/autodiscovery/autoconfig/src/main/kotlin/app/k9mail/autodiscovery/autoconfig/RealAutoconfigFetcher.kt b/feature/autodiscovery/autoconfig/src/main/kotlin/app/k9mail/autodiscovery/autoconfig/RealAutoconfigFetcher.kt
index e0ad7ff19..6a06e2d48 100644
--- a/feature/autodiscovery/autoconfig/src/main/kotlin/app/k9mail/autodiscovery/autoconfig/RealAutoconfigFetcher.kt
+++ b/feature/autodiscovery/autoconfig/src/main/kotlin/app/k9mail/autodiscovery/autoconfig/RealAutoconfigFetcher.kt
@@ -42,6 +42,7 @@ internal class RealAutoconfigFetcher(
                     AutoDiscoveryResult.Settings(
                         incomingServerSettings = parserResult.incomingServerSettings,
                         outgoingServerSettings = parserResult.outgoingServerSettings,
+                        isTrusted = false,
                     )
                 }
                 is ParserError -> AutoDiscoveryResult.NoUsableSettingsFound
diff --git a/feature/autodiscovery/autoconfig/src/test/kotlin/app/k9mail/autodiscovery/autoconfig/MockAutoconfigFetcher.kt b/feature/autodiscovery/autoconfig/src/test/kotlin/app/k9mail/autodiscovery/autoconfig/MockAutoconfigFetcher.kt
index 74acadbb0..aa8e5ac91 100644
--- a/feature/autodiscovery/autoconfig/src/test/kotlin/app/k9mail/autodiscovery/autoconfig/MockAutoconfigFetcher.kt
+++ b/feature/autodiscovery/autoconfig/src/test/kotlin/app/k9mail/autodiscovery/autoconfig/MockAutoconfigFetcher.kt
@@ -49,6 +49,7 @@ internal class MockAutoconfigFetcher : AutoconfigFetcher {
                 authenticationType = PasswordCleartext,
                 username = "irrelevant@domain.example",
             ),
+            isTrusted = true,
         )
         val RESULT_TWO = AutoDiscoveryResult.Settings(
             incomingServerSettings = ImapServerSettings(
@@ -65,6 +66,7 @@ internal class MockAutoconfigFetcher : AutoconfigFetcher {
                 authenticationType = PasswordEncrypted,
                 username = "irrelevant@company.example",
             ),
+            isTrusted = true,
         )
     }
 }
diff --git a/feature/autodiscovery/service/src/test/kotlin/app/k9mail/autodiscovery/service/PriorityParallelRunnerTest.kt b/feature/autodiscovery/service/src/test/kotlin/app/k9mail/autodiscovery/service/PriorityParallelRunnerTest.kt
index 56f1d1840..08195935b 100644
--- a/feature/autodiscovery/service/src/test/kotlin/app/k9mail/autodiscovery/service/PriorityParallelRunnerTest.kt
+++ b/feature/autodiscovery/service/src/test/kotlin/app/k9mail/autodiscovery/service/PriorityParallelRunnerTest.kt
@@ -155,6 +155,7 @@ class PriorityParallelRunnerTest {
                 authenticationType = PasswordCleartext,
                 username = "user@domain.example",
             ),
+            isTrusted = true,
         )
 
         private val DISCOVERY_RESULT_TWO = AutoDiscoveryResult.Settings(
@@ -172,6 +173,7 @@ class PriorityParallelRunnerTest {
                 authenticationType = PasswordCleartext,
                 username = "user@domain.example",
             ),
+            isTrusted = true,
         )
     }
 }