Network ports · 993
993 — IMAPS
Port 993 is IMAP over TLS, encrypted from the first byte.
Key facts
| Port | 993 |
|---|---|
| Transport | TCP |
| Service | IMAP over TLS |
| Encryption | Implicit TLS |
| Preference | Default for modern mail clients |
| Range | Well-known (0–1023) |
TLS before protocol
The client opens a TLS connection to port 993 and only then speaks IMAP. There is no clear-text phase and no STARTTLS negotiation, so credentials and folder names cannot leak before encryption begins. This is the configuration modern clients choose by default.
The certificate must match the mail hostname, not just the domain. A mismatch causes a warning or a refusal, and bypassing it removes most of the protection.
Troubleshooting
If IMAPS fails while port 143 works, the usual causes are a blocked port, an expired certificate, or a client configured with the wrong hostname. Test the TLS handshake first, then authentication.
Keep the server certificate renewed automatically. Mail clients often cache the old certificate and surface a warning only after the expiry date.
Frequently asked questions
Is 993 better than 143 with STARTTLS?
It is simpler and avoids the clear-text window. Both are secure when STARTTLS is enforced correctly.
What port does IMAP use without TLS?
143. It can upgrade with STARTTLS but starts in clear text.