SMTP vs IMAP
Email infrastructure uses three protocols: SMTP for sending (RFC 5321), IMAP for synchronized multi-device access (RFC 9051), and POP3 for simple single-device download (RFC 1939). SMTP is a push protocol – messages flow from sender's client to sender's server to recipient's server. IMAP is a pull protocol – the client accesses messages stored on the server. They operate on different ports and serve completely different roles in the email stack.
SMTP sends email – it's the outbound delivery protocol used from client to server and server to server. IMAP retrieves email – it's the inbound access protocol that keeps messages on the server and synchronizes state across devices. They solve opposite sides of the email problem and are always used together, never interchangeably.
| Feature | SMTP | IMAP |
|---|---|---|
| Direction | Outbound – sends mail from client to server or server to server | Inbound – retrieves mail stored on server |
| Role | Mail Transfer Agent (MTA) and Mail Submission Agent (MSA) | Mail Access Protocol – read, organize, search |
| Port (plaintext) | 25 (server-to-server), 587 (client submission) | 143 (with STARTTLS) |
| Port (TLS) | 465 (implicit TLS submission) | 993 (implicit TLS) |
| Message storage | Does not store messages – transfer only | Messages stay on server – synchronized across all devices |
| Multi-device sync | Not applicable | Core feature – read/unread, folders, flags sync everywhere |
| Server-side search | Not applicable | Full-text search on server without downloading all messages |
| Authentication | AUTH command (PLAIN, LOGIN, CRAM-MD5, OAuth2) | LOGIN command, AUTHENTICATE (OAuth2 XOAUTH2) |
| Connection model | Transactional – connect, send, disconnect | Persistent – long-lived connections, IDLE for push notifications |
| RFC | RFC 5321 | RFC 9051 |
When to use SMTP
SMTP is always used for sending email – there is no alternative. Your email client uses port 587 (or 465) to submit outgoing mail to your provider's SMTP server. Your provider's SMTP server uses port 25 to deliver to the recipient's mail server. Every email send, without exception, goes through SMTP.
When to use IMAP
IMAP is the correct choice for reading email in any scenario involving more than one device or webmail access. Gmail, Outlook, Apple Mail, and Thunderbird all use IMAP. The alternative (POP3) downloads messages and deletes them from the server – appropriate only for single-device setups that need local offline archives.
Common Mistakes
- Confusing SMTP and IMAP as alternatives to each other – they are not. Every email deployment uses both: SMTP for sending, IMAP for receiving. They cannot be swapped.
- Using port 25 for email client submission – port 25 is for server-to-server relay and is blocked by most ISPs for client connections. Use port 587 (STARTTLS) or 465 (implicit TLS) for client submission.
- Leaving SMTP relay open without authentication – an open relay that accepts mail from anyone and forwards it is immediately exploited for spam. SMTP servers must require authentication for submission.
- Using POP3 instead of IMAP for a multi-device setup – POP3 downloads and deletes messages from the server. If you read on your phone, the messages are gone when you check on your desktop.
- Hardcoding SMTP credentials in application code – use environment variables or secrets management. SMTP credentials leak via source control repositories constantly.
FAQ
Why does email need both SMTP and IMAP? Can't one protocol do both?
They were deliberately separated. SMTP is a push/delivery protocol – optimized for reliably transferring messages between servers. IMAP is a storage-access protocol – optimized for efficiently accessing a mailbox with folder management, flags, search, and synchronization. Combining them would make both worse. The separation also allows different servers to handle sending and receiving (e.g., use Gmail's SMTP but your own IMAP server).
What is the difference between SMTP port 25, 465, and 587?
Port 25 is for server-to-server mail delivery (MTA-to-MTA). ISPs block outbound port 25 from residential/business connections to prevent spam. Port 587 is for authenticated client submission with STARTTLS – your email client uses this. Port 465 is for authenticated client submission with implicit TLS (TLS from the first byte) – RFC 8314 recommends 465 over 587 for new clients because it eliminates the STARTTLS stripping attack.
What replaced IMAP?
Nothing yet for general email clients. JMAP (JSON Meta Application Protocol, RFC 8620) is a modern API-based replacement designed for efficiency and mobile clients, but adoption is limited to Fastmail and a few others. For proprietary ecosystems, Microsoft uses Exchange ActiveSync (EAS) and Google uses their own API for native apps – but IMAP remains the universal interoperable standard.