Port 143: IMAP
Port 143 is IMAP, which keeps your mail on the server and syncs it to every device. It is unencrypted by default; the encrypted equivalent is IMAPS on port 993, which is what nearly every mail client uses.
| Port number | 143 |
|---|---|
| Service | Internet Message Access Protocol |
| Protocol | TCP |
| Category | |
| Default encryption | No |
| IANA service name | imap |
| IANA transports | TCP |
| Used in practice | TCP |
Is port 143 with STARTTLS as safe as port 993?
In principle a STARTTLS connection on port 143 ends up with the same TLS protection as an implicit TLS connection on port 993. The difference is what happens before the upgrade, and what happens when it fails.
On port 143 the session begins in clear text and the client asks to upgrade. A network attacker who can modify traffic can strip the server's advertisement of STARTTLS, and a client that has not been configured to require encryption will then carry on in plaintext and send the password anyway. On port 993 there is no plaintext phase to attack: TLS either succeeds or the connection does not happen.
That is why RFC 8314 recommends implicit TLS on the dedicated port over cleartext-plus-STARTTLS for mail access. If a client only supports port 143, insist on a setting that requires TLS rather than merely preferring it.
Which ports are related to port 143?
The port a reader usually needs next is the encrypted or plaintext twin of this one, so those are listed first rather than buried in a generic list.
| Port | Relationship | Why it matters |
|---|---|---|
| 993 | encrypted | IMAPS, IMAP inside implicit TLS. The connection is encrypted before any command is sent. |
| 110 | companion | POP3, the older model that downloads mail to one device and removes it from the server. |
| 587 | companion | Mail submission. IMAP only reads mail; sending needs a submission port as well. |
What commonly listens on port 143?
- Dovecot, the most widely deployed IMAP server on Linux
- Cyrus IMAP in larger deployments
- Microsoft Exchange, where IMAP access is optional and often disabled
How do I check whether port 143 is open?
Port 143 carries TCP, so a connection either completes its handshake or it does not, which makes the check definitive.
| Question | Command | What to know |
|---|---|---|
| Is it open on a remote host? | nc -vz example.com 143 | A TCP handshake either completes or it does not, so netcat gives a definitive answer in one line. |
| Same check on Windows | Test-NetConnection example.com -Port 143 | Built into PowerShell. TcpTestSucceeded in the output is the answer; telnet is not installed by default on modern Windows. |
| What is listening locally? | ss -tlnp | grep ':143 ' | Lists the process bound to port 143 on Linux. On macOS use lsof -nP -iTCP:143 -sTCP:LISTEN, on Windows netstat -ano | findstr :143 |
Replace example.com with the host you are testing. A blocked port and a port with nothing listening on it look identical from the outside, so if a service should be running, check locally before blaming the firewall.
Frequently asked questions
Is port 143 TCP or UDP?
TCP only. This is clearer than for most well-known ports: IANA assigns imap to TCP 143 and lists UDP 143 as Reserved with no service, so there is nothing on UDP to allow.
What is the difference between port 143 and port 993?
Both carry IMAP. Port 143 starts unencrypted and can optionally upgrade with STARTTLS; port 993 is encrypted with TLS from the first byte. Port 993 is what nearly all mail clients use and what current guidance recommends.
What is port 143 used for?
Port 143 is IMAP, which keeps your mail on the server and syncs it to every device. It is unencrypted by default; the encrypted equivalent is IMAPS on port 993, which is what nearly every mail client uses.
Is port 143 secure?
Port 143 is not encrypted by default. Where possible, use an encrypted alternative or tunnel it over TLS or a VPN.
Should I open port 143 on my firewall?
Only if you specifically need IMAP. Expose it to the smallest set of trusted sources, and never open database or Windows-service ports to the whole internet.