Skip to content
Webmaster Tools
SecurityPort ScannerPort 993 (IMAPS)

Port 993 (IMAPS)

Port 993 is IMAP over implicit TLS, the recommended port for mail apps reading mail. Client settings, Dovecot config, firewall rules and how to test the certificate.

What runs on port 993

TCP port 993 is IMAPS: IMAP inside a TLS connection that starts immediately, before any IMAP command. Mail apps on phones and computers use it to read mail kept on the server, with folders and read state synced across devices. Everything, including the login, is encrypted.

It is the encrypted counterpart of port 143, where IMAP starts in plain text and upgrades with STARTTLS. RFC 8314 recommends implicit TLS on 993 for mail clients, because there is no plain-text phase that an attacker could use to strip the upgrade.

Client settings

Setting Value
Incoming server mail.example.com (your provider's IMAP host)
Port 993
Security SSL/TLS (sometimes just "SSL")
Username Usually the full email address
Password Account password, or an app password if the provider requires one

If the client asks for "STARTTLS" with 993, or "SSL/TLS" with 143, the connection will hang or fail. Match the security setting to the port.

Should it be open to the internet?

On a mail server whose users read mail from anywhere, yes. It is the one IMAP port worth keeping open; 143 can usually be closed. With Dovecot:

# /etc/dovecot/conf.d/10-ssl.conf
ssl = required
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.example.com/privkey.pem
ssl_min_protocol = TLSv1.2

sudo ufw allow 993/tcp

iptables -A INPUT -p tcp --dport 993 -j ACCEPT

Setting names differ between Dovecot 2.3 and 2.4, so check the documentation for your version. After renewing a certificate, reload Dovecot (sudo systemctl reload dovecot) or it keeps serving the old one.

Test it

openssl s_client -connect mail.example.com:993 -crlf -quiet

You should see the certificate chain and then a line starting * OK. Type a1 CAPABILITY to list the server's features and a2 LOGOUT to leave. Our SSL Checker shows the certificate's expiry date, chain and TLS version from the outside.

For a quick reachability test without TLS details: nc -zv mail.example.com 993.

See what is listening

sudo ss -tlnp 'sport = :993'
sudo lsof -i :993

The process is usually dovecot. If Dovecot fails to start with "Address already in use", another IMAP server (Courier, Cyrus, or a second Dovecot instance) holds the port.

Common problems

  • Certificate name mismatch: the certificate covers example.com but clients connect to mail.example.com. Issue one that includes the mail hostname.
  • Expired certificate: renewal ran, but Dovecot was not reloaded.
  • Missing intermediate: use fullchain.pem, not cert.pem, or some phones refuse the connection.
  • Login works on webmail but not IMAP: the provider may require an app password or OAuth for IMAP, or IMAP access may be switched off in the account settings.

Security notes

  • Brute force against IMAP logins is common. Use fail2ban or Dovecot's built-in auth penalty.
  • Disable old TLS versions (1.0 and 1.1).
  • Watch for logins from unexpected countries, a common sign of a leaked password.

Check which mail ports your server answers on from the public internet with the Port Scanner.