IMAP

The important point about IMAP is that your email stays on the server. The client only shows you a synchronized view of it. If you read a message on your phone, it shows as read on your laptop too. If you move an email into a folder on one device, it appears in that folder everywhere else. This is the main difference from POP3, the older protocol, which typically downloads messages to a single device and removes them from the server.

IMAP handles only retrieving and managing mail. Sending email is a separate job handled by SMTP. A typical mail client setup therefore has two parts: IMAP for incoming mail and SMTP for outgoing mail.

By default, IMAP uses port 143. The secure version, which wraps the connection in TLS, uses port 993. The current version of the protocol is IMAP4rev2, defined in RFC 9051.

From a security perspective, a few points matter. Plain IMAP on port 143 without STARTTLS sends credentials and message content in clear text, so it should never be allowed in production. Only encrypted connections should be permitted. IMAP is also a common target for password spraying and credential stuffing attacks, because older setups often rely on simple username and password logins that bypass multi-factor authentication. For this reason, many organizations, including Microsoft for Exchange Online, have disabled basic authentication for IMAP and require modern authentication methods such as OAuth 2.0. If your environment doesn't need IMAP at all, the safest choice is to disable it entirely and monitor for any login attempts against it.

In short, IMAP keeps your email on the server and keeps all your devices in sync. It is convenient and widely used, but it should always be encrypted and protected with modern authentication.