Skip to content
Webmaster Tools
SecurityPort ScannerPort 143 (IMAP)

Port 143 (IMAP)

Port 143 is IMAP, the protocol mail apps use to read mail kept on the server. STARTTLS vs port 993, Dovecot settings, firewall rules and how to test it.

What runs on port 143

TCP port 143 is IMAP, the Internet Message Access Protocol (current version IMAP4rev2, RFC 9051). Mail apps such as Thunderbird, Apple Mail and Outlook use it to read mail that stays on the server: folders, read and flagged state are kept there and synced across every device.

IMAP on 143 starts unencrypted and upgrades with the STARTTLS command. If the server or client skips that step, the password and messages travel in clear text. The alternative is port 993, where TLS starts immediately.

143 or 993?

Port 143 Port 993
Encryption Upgraded with STARTTLS TLS from the first byte
Downgrade risk An attacker can strip the STARTTLS offer if the client doesn't insist None
Recommended for clients No Yes (RFC 8314)

RFC 8314 (2018) recommends that mail clients use implicit TLS on 993. Some clients still default to 143 with STARTTLS, which is fine as long as they refuse to continue without it.

Should it be open to the internet?

If you run a mail server and offer 993, you can usually close 143. Keep it only for old clients that can't use 993, and then require TLS before login. In Dovecot 2.3:

# /etc/dovecot/conf.d/10-ssl.conf
ssl = required
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.example.com/privkey.pem

# /etc/dovecot/conf.d/10-auth.conf
disable_plaintext_auth = yes

To stop Dovecot listening on 143 altogether while keeping 993:

# /etc/dovecot/conf.d/10-master.conf
service imap-login {
  inet_listener imap {
    port = 0
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}

Dovecot 2.4 renamed several settings, so check the documentation for your version. Then the firewall:

sudo ufw allow 993/tcp
sudo ufw deny 143/tcp

Test it by hand

openssl s_client -connect mail.example.com:143 -starttls imap

You should see the certificate chain and then an IMAP OK line. Without TLS, nc mail.example.com 143 shows the greeting; a1 CAPABILITY lists STARTTLS if it is offered and LOGINDISABLED if plain logins are refused (which is what you want), then a2 LOGOUT.

See what is listening

sudo ss -tlnp 'sport = :143'
sudo lsof -i :143

Usually dovecot, sometimes Courier or Cyrus. Hosted control panels often enable both 143 and 993 by default.

Security notes

  • Brute force and password spraying hit IMAP constantly. Use fail2ban, strong passwords, and app passwords where your provider supports them.
  • Don't let clients fall back to plain text. In the account settings pick "SSL/TLS" on 993, or "STARTTLS" on 143, never "None".
  • Certificate name: the certificate must cover the hostname clients use, such as mail.example.com.
  • Legacy auth: some providers have turned off IMAP with basic passwords entirely in favor of OAuth. Check your provider's current policy before debugging a login failure.

Check which mail ports your server answers on from the public internet with the Port Scanner.