Skip to main content
protocols.pageprotocols.page
993

Port 993 – IMAPS

TCP

Port 993 is IMAPS – IMAP with implicit TLS. TLS is established immediately on connection before any IMAP protocol exchange. This is the secure version of IMAP port 143. All modern email clients default to port 993 for IMAP. The implicit TLS model means no STARTTLS stripping attack is possible.

Port Number

993

Protocol

TCP

Service

IMAP over TLS

Range

IANA Well-Known (0–1023)

Description

IMAPS on port 993 wraps the entire IMAP session in TLS from the first byte. Compared to IMAP with STARTTLS on port 143, IMAPS is simpler (no protocol upgrade step) and immune to STARTTLS stripping. IMAP over TLS on port 993 has been the default for secure email clients since the early 2000s.

Security risks

  • 1Certificate misconfiguration: IMAPS on 993 requires a valid TLS certificate matching the mail server hostname. Self-signed certs cause client connection failures or teach users to click through security warnings – use Let's Encrypt or a proper CA.
  • 2Brute-force login: port 993 is a common target for credential stuffing against email accounts. Implement fail2ban monitoring Dovecot/Courier auth logs and enforce account lockout after repeated failures.
  • 3IDLE connection abuse: IMAP IDLE keeps connections open indefinitely for push notifications. Attackers can exhaust server connection limits with many IDLE sessions. Set per-user connection limits (mail_max_userip_connections in Dovecot).

Firewall guidance

Allow inbound 993 on mail servers that serve external email clients. This is the standard IMAP port for all modern clients (iOS Mail, Thunderbird, Outlook). No reason to restrict by source IP unless your mail server is internal-only. Rate-limit authentication attempts to prevent brute-force.

Diagnosis commands

Test TLS connection and view certificate (should connect immediately with TLS)

shell
openssl s_client -connect host:993

Test IMAP login and mailbox access over TLS

shell
curl -v imaps://host:993/INBOX -u user:pass --ssl-reqd

Audit TLS cipher suites on IMAPS port

shell
nmap -p 993 --script ssl-enum-ciphers target

Usage examples

Port 993 – IMAPS
shell
openssl s_client -connect mail.example.com:993
curl --ssl-reqd imaps://mail.example.com/INBOX

Common services on this port

DovecotCyrus IMAPMicrosoft ExchangeGmailFastmailZimbraCourier

Related ports

143

IMAP (STARTTLS)

587

SMTP submission

465

SMTPS

995

POP3S

History

Port 993 was assigned for IMAPS in RFC 2595 (1999). It became the universal standard for secure email access as webmail and mobile clients proliferated in the 2000s. RFC 8314 (2018) reaffirmed implicit TLS on dedicated ports as preferred over STARTTLS.

FAQ

Port 993 vs 143 with STARTTLS?

Both encrypt the connection. Port 993 (implicit TLS) is simpler and immune to STARTTLS stripping attacks. Port 143 with STARTTLS works but has a brief plaintext window during negotiation. RFC 8314 recommends 993 for new configurations.

Specification

RFC 8314 – Port 993 specification →