PORTSTARTTLSIANA assigned
Port 143IMAP
Port 143 is the standard TCP port for IMAP (Internet Message Access Protocol), which lets mail clients read and manage messages that stay on the server. Connections on 143 start unencrypted and are upgraded with STARTTLS; port 993 offers the same service with TLS from the start.
What port 143 is used for
IMAP is the protocol behind almost every modern mail client's inbox. Messages stay on the server; the client fetches headers and bodies on demand, marks messages read, moves them between folders and searches server-side. Because the state lives on the server, a phone, a laptop and a webmail session all see the same mailbox.
Port 143 is the original IMAP port. Clients that use it are expected to issue STARTTLS immediately after connecting, before sending credentials.
| Setting | STARTTLS variant | Implicit TLS variant |
|---|---|---|
| Port | 143 | 993 |
| Client security option | STARTTLS | SSL/TLS |
Security considerations
- Require TLS in the client. A client that allows the STARTTLS step to fail silently will send the password in clear text.
- Providers may disable plain 143. Many large providers accept only 993. Follow the provider's documented settings.
- Use OAuth where offered. Major providers support modern authentication for IMAP, avoiding stored passwords.
- Server operators: set
disable_plaintext_auth = yes(Dovecot) or the equivalent, so authentication is refused until TLS is active.
How to check port 143
Is something listening locally? On Windows, open Command Prompt and run:
netstat -ano | findstr :143A line in the LISTENING state means a local program has bound port 143; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :143 or lsof -i :143.
Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:
Test-NetConnection imap.example.com -Port 143TcpTestSucceeded : True means the remote system accepted a TCP connection on port 143. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.
See the netstat and Test-NetConnection records for the full option sets.
Check that STARTTLS is offered:
curl -v imap://imap.example.com:143 -X CAPABILITYLook for STARTTLS in the capability list.
Firewall considerations
Mail servers need inbound 143 if they offer STARTTLS IMAP; otherwise close it and serve 993 only. Client networks should allow outbound 143 and 993.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 143 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
143 or 993 for IMAP?
Both are secure when TLS is required. 993 encrypts from the first byte and is what most providers document. Use 143 only when the provider specifies STARTTLS on that port.
Why does IMAP need to stay connected?
IMAP clients keep a session open and use the IDLE command so the server can push new-message notifications. Long-lived connections on 143 or 993 are normal.