When setting up an account using a Google Apps domain, Kube correctly identifies Google as a service provider, and instructs the user on how to enable IMAP and "less secure applications".

The problem is that for users with 2-step authentication (which should be the norm), "less secure applications" are not allowed. Instead users need to set up an application password in https://myaccount.google.com/apppasswords . It is pretty straight forward process and Kube can easily instruct the user on how do that.