PORTImplicit TLSIANA assigned
Port 993IMAP over TLS (IMAPS)
Port 993 is the standard TCP port for IMAP over TLS (IMAPS). The connection is encrypted from the start, so credentials and messages are protected. It is the incoming-mail port most providers document, alongside 587 or 465 for outgoing mail.
What port 993 is used for
Port 993 is IMAP wrapped in TLS from the first byte. It has been the de facto secure IMAP port since the late 1990s and is the recommended one under RFC 8314. When a mail client shows the "SSL/TLS" option for incoming mail, it means port 993.
Typical incoming-mail settings:
| Setting | Value |
|---|---|
| Server | imap.provider.example |
| Port | 993 |
| Security | SSL/TLS |
| Authentication | Password, app password or OAuth |
Security considerations
- Certificate validation is the whole point. The client must verify the server's certificate; otherwise an attacker can present their own.
- Long-lived connections are normal. IMAP IDLE keeps a session open for push notifications. Network equipment that drops idle TCP sessions aggressively causes "connection lost" errors in mail apps.
- Server side: disable TLS 1.0 and 1.1, renew certificates before expiry, and log authentication failures.
How to check port 993
Is something listening locally? On Windows, open Command Prompt and run:
netstat -ano | findstr :993A line in the LISTENING state means a local program has bound port 993; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :993 or lsof -i :993.
Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:
Test-NetConnection imap.example.com -Port 993TcpTestSucceeded : True means the remote system accepted a TCP connection on port 993. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.
See the netstat and Test-NetConnection records for the full option sets.
Verify the TLS certificate:
curl -v imaps://imap.example.com:993 -X CAPABILITYFirewall considerations
Mail servers need inbound 993 from wherever users read mail. Client networks should allow outbound 993. No workstation needs an inbound rule.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 993 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
What are the standard secure mail ports?
Incoming: 993 (IMAPS) or 995 (POP3S). Outgoing: 465 (implicit TLS) or 587 (STARTTLS). All four require authentication.
Why does my mail app say the certificate is not trusted on 993?
The server presented a certificate that does not match its name, is expired, or is issued by an unknown authority. Check that the server name in the app matches the provider's documentation exactly; if it does, the provider has a certificate problem. Do not permanently accept an untrusted certificate.