Port 993: IMAPS
Port 993 is IMAPS, IMAP over implicit TLS, and it is TCP. The connection is encrypted before the first command is sent, which is why nearly every mail client uses 993 rather than plain IMAP on port 143.
| Port number | 993 |
|---|---|
| Service | IMAP over TLS |
| Protocol | TCP |
| Category | |
| Default encryption | Yes (TLS/SSH) |
| IANA service name | imaps |
| IANA transports | TCP |
| Used in practice | TCP |
What is the difference between port 993 and port 143?
They carry the same protocol. The difference is when encryption starts and what happens if it does not.
Port 993 is implicit TLS: the TLS handshake completes before any IMAP command exists, so there is never a moment where a password or a message body could be sent in the clear, and there is no negotiation for an attacker to tamper with.
Port 143 starts in clear text. The client reads the server's capabilities, sees STARTTLS offered, and asks to upgrade. If an attacker on the path strips STARTTLS from that capability list, a client configured to require TLS aborts, but a client configured merely to prefer it continues in plaintext and sends the password anyway. RFC 8314 recommends implicit TLS on the dedicated port for exactly this reason.
Why is my mail client failing to connect on port 993?
Three causes account for most of it. The first is a certificate problem: implicit TLS means the certificate is validated at the very start, so an expired certificate or a hostname mismatch produces a connection failure rather than a warning after login. Check that the hostname in the client matches the certificate exactly, mail.example.com and example.com are not interchangeable.
The second is the provider having IMAP disabled. Microsoft 365 and Google Workspace both allow administrators to turn IMAP access off per mailbox, and both have moved to requiring OAuth rather than a password for IMAP, so an app password or modern-auth-capable client may be needed.
The third is a client set to STARTTLS on port 993 rather than SSL/TLS. Those settings are not interchangeable: port 993 expects TLS immediately and will not answer a plaintext STARTTLS greeting. Port 993 wants SSL/TLS, port 143 wants STARTTLS.
Which ports are related to port 993?
The port a reader usually needs next is the encrypted or plaintext twin of this one, so those are listed first rather than buried in a generic list.
| Port | Relationship | Why it matters |
|---|---|---|
| 143 | plaintext | Plain IMAP, which begins unencrypted and may or may not upgrade with STARTTLS. |
| 995 | companion | POP3S, the encrypted version of the older download-and-delete mail model. |
| 465 | companion | Mail submission over implicit TLS. Port 993 only reads mail; sending needs a submission port. |
What commonly listens on port 993?
- Dovecot, by far the most common IMAP server on Linux hosting
- Cyrus IMAP in university and enterprise deployments
- Microsoft Exchange and Microsoft 365, where IMAP access can be enabled per mailbox
- Every desktop and mobile mail client: Apple Mail, Outlook, Thunderbird, K-9
How do I check whether port 993 is open?
Port 993 carries TCP, so a connection either completes its handshake or it does not, which makes the check definitive.
| Question | Command | What to know |
|---|---|---|
| Is it open on a remote host? | nc -vz example.com 993 | A TCP handshake either completes or it does not, so netcat gives a definitive answer in one line. |
| Same check on Windows | Test-NetConnection example.com -Port 993 | Built into PowerShell. TcpTestSucceeded in the output is the answer; telnet is not installed by default on modern Windows. |
| What is listening locally? | ss -tlnp | grep ':993 ' | Lists the process bound to port 993 on Linux. On macOS use lsof -nP -iTCP:993 -sTCP:LISTEN, on Windows netstat -ano | findstr :993 |
Replace example.com with the host you are testing. A blocked port and a port with nothing listening on it look identical from the outside, so if a service should be running, check locally before blaming the firewall.
Frequently asked questions
Is port 993 TCP or UDP?
TCP. IANA assigns imaps to TCP 993 and lists UDP 993 as Reserved with no service, so there is nothing on UDP to allow. Firewall rules should permit TCP 993 only.
What is port 993 used for?
Reading mail over an encrypted connection. It is IMAP wrapped in implicit TLS, so a mail client connects, the TLS handshake completes first, and only then does it log in and sync mailboxes. It does not send mail: that needs a submission port, 465 or 587.
Should I use port 993 or 143 with STARTTLS?
993. Both can end up equally encrypted, but on 143 the session starts in cleartext and the upgrade can be stripped by an attacker on the network path, whereas on 993 there is no plaintext phase to attack. RFC 8314 recommends implicit TLS for mail access.
Do I need port 993 and port 587 both open?
For a normal mail account, yes. Port 993 reads mail from the server and a submission port sends it, either 465 for implicit TLS or 587 for STARTTLS. They are separate protocols, so opening only one gives you a client that can read but not send, or send but not read.
Is port 993 secure?
Yes. Port 993 carries encrypted traffic by default, so data in transit is protected.
Should I open port 993 on my firewall?
Only if you specifically need IMAPS. Expose it to the smallest set of trusted sources, and never open database or Windows-service ports to the whole internet.