Port 143 — TCP
TCP port 143 supports IMAP mailbox access and synchronization. It can upgrade the session with STARTTLS, unlike the implicit TLS commonly used on port 993. Diagnose TCP connectivity, TLS negotiation and account authentication separately.
What is port 143 used for?
IMAP on TCP 143 lets clients access and synchronize server-side messages. The server may support STARTTLS to upgrade the connection to TLS. Port 993 commonly uses implicit TLS. A successful network connection alone does not validate encryption or account authentication.
Separate DNS resolution, TCP transport, TLS negotiation and IMAP commands during diagnosis.
Transport protocol
TCP
Security precautions
Prefer IMAPS on port 993 or properly enforced STARTTLS on port 143.
Should we open this port in the firewall?
Avoid unencrypted IMAP authentication over untrusted networks. If port 143 remains in use, require STARTTLS where supported or migrate clients to implicit TLS on 993. Internet access may be legitimate for remote clients, but it must be intentional and protected by the mail platform's authentication controls.
How do I check this port?
Test TCP 143 and inspect the server's advertised capabilities. If STARTTLS is expected, openssl s_client -starttls imap -connect SERVER:143 helps inspect TLS negotiation and the certificate.
- Validate DNS resolution and TCP connectivity.
- Check whether STARTTLS is required and accepted.
- Verify the permitted authentication methods.
- Compare with port 993 if clients are configured for implicit TLS.
FAQ — port 143 / IMAP
What is the difference between IMAP 143 and IMAPS 993?
Port 143 supports IMAP with a possible STARTTLS upgrade, depending on server configuration. Port 993 commonly starts IMAP over implicit TLS.
Why is port 143 reachable while Outlook cannot connect?
The failure may occur after TCP connection establishment: STARTTLS requirements, certificate validation, authentication methods or mailbox settings can prevent access.
Can port 143 be closed when 993 is active?
Yes, if no client or service still depends on 143. Check actual usage before removing the listener.