-POP server.
-
-If nmh has been compiled with KPOP #defined, but without POPSERVICE being set to
-"kpop", the -kpop switch may be specified to cause the use of Kerberized POP
-rather than standard POP3 during a given invocation of \fImsgchk\fR.
-%nmhendpop%
-.Fi
+POP server. If
+.B \-oauth
+is used, the HTTP transaction is also shown.
+.PP
+If
+.B nmh
+has been compiled with SASL support, the
+.B \-sasl
+switch will enable
+the use of SASL authentication. Depending on the SASL mechanism used, this
+may require an additional password prompt from the user (but the
+.I netrc
+file can be used to store this password, as described in the
+mh-profile(5) man page). The
+.B \-saslmech
+switch can be used to select a particular SASL mechanism.
+.PP
+If SASL authentication is successful,
+.B msgchk
+will attempt to negotiate
+a security layer for session encryption. Encrypted traffic is labelled
+with `(encrypted)' and `(decrypted)' when viewing the POP transaction
+with the
+.B \-snoop
+switch.
+.PP
+If
+.B nmh
+has been compiled with OAuth support, the
+.B \-oauth
+switch will enable OAuth authentication. The
+.B \-user
+switch must be used, and the
+.I user-name
+must be an email address the user has for that service. Before using this,
+the user must authorize nmh by running
+.B mhlogin
+and grant authorization to that account. Only
+.B -oauth
+.I gmail
+is supported. See the
+.B mhlogin
+man page for more details.
+.PP
+Gmail only supports POP3 over TLS, but
+.B msgchk
+has no TLS support. To work around this, use something like
+.B -proxy 'openssl s_client -connect %h:995 -CAfile /etc/ssl/certs/ca-certificates.crt -quiet'
+.SH FILES
+.fc ^ ~
+.nf
+.ta \w'%nmhetcdir%/ExtraBigFileName 'u