What is IMAP? How IMAP works: ports, sync and security

IMAP, the Internet Message Access Protocol, is how a mail app reads mail that lives on a server. The messages stay put and the app keeps a copy, so a message you read or file on your phone is read or filed on your laptop too.

What is IMAP used for?

IMAP is for working with mail that stays on a server. RFC 9051 describes it as handling "remote message folders" in a way that is functionally equivalent to local ones: a client can create folders, search on the server, fetch a whole message or one part of it, set flags and move messages. Because the server holds the mailbox, any number of devices can use it at once.

What is the difference between IMAP and SMTP?

IMAP reads mail that has already arrived. Sending is SMTP's job, on port 465 or 587, so a mail app usually speaks both. What is SMTP? covers the sending side, and What is an email client? shows how apps combine the two.

IMAP versions, from IMAP2 to IMAP4rev2

Mark Crispin published IMAP2, the first IMAP RFC, as RFC 1064 in July 1988, when the letters stood for Interactive Mail Access Protocol.

RFC 9051 obsoletes RFC 3501 and folds twelve extensions into the base protocol: NAMESPACE, UNSELECT, UIDPLUS, ESEARCH, SEARCHRES, ENABLE, IDLE, SASL-IR, LIST-EXTENDED, LIST-STATUS, MOVE and LITERAL-, along with the SPECIAL-USE folder attributes. CONDSTORE and QRESYNC, which make resyncing fast, stayed optional, so as not to set the bar too high for new implementations.

RFC 9051 lets a server announce both versions. When we sent CAPABILITY to five providers on 31 October 2026, Gmail, Outlook.com, iCloud and Yahoo announced IMAP4rev1 but not IMAP4rev2, and Fastmail announced both.

What port does IMAP use?

IMAP uses port 993 or port 143:

Use 993. RFC 8314, "Cleartext Considered Obsolete" (2018), recommends implicit TLS over STARTTLS for reading and sending mail. Its authors, one of whom wrote RFC 2595, the STARTTLS standard for IMAP and POP, now say that approach was a mistake: a separate port is simpler, and STARTTLS led several implementers to the same command injection bug. A 2021 USENIX Security study reported more than 40 STARTTLS issues, and found only 3 of 28 mail clients free of them. Gmail (imap.gmail.com) and Outlook.com (outlook.office365.com) both serve IMAP on 993.

Is IMAP secure?

On port 993, yes: the whole session is encrypted, the password included. On 143 without STARTTLS the password travels in plain text, and RFC 9051 tells clients never to use LOGIN there. The weak point now is the password: Microsoft notes that multifactor authentication is hard to enforce while password sign-in stays on, one reason providers moved to OAuth.

How does IMAP work?

An IMAP session is one long-lived connection carrying lines of text. The client starts each command with a tag, such as a1. The server replies with untagged lines starting with *, then a line that repeats the tag and says OK, NO or BAD. A + asks the client to continue. Untagged lines can also arrive unasked, which is how new mail is reported.

A session moves through four states: not authenticated, authenticated, selected and logout. Here is one on port 993, after the TLS handshake, with C: for the client and S: for the server:

S: * OK IMAP server readyC: a1 CAPABILITYS: * CAPABILITY IMAP4rev1 SASL-IR AUTH=PLAIN AUTH=XOAUTH2 IDLE MOVE SPECIAL-USES: a1 OK CAPABILITY completedC: a2 AUTHENTICATE PLAIN AGFkYUBleGFtcGxlLmNvbQBhcHAtcGFzc3dvcmQ=S: a2 OK Logged inC: a3 SELECT INBOXS: * 172 EXISTSS: * FLAGS (\Answered \Flagged \Deleted \Seen \Draft)S: * OK [UIDVALIDITY 1761868800] UIDs validS: * OK [UIDNEXT 4392] Predicted next UIDS: a3 OK [READ-WRITE] SELECT completedC: a4 UID SEARCH UNSEENS: * SEARCH 4388 4391S: a4 OK SEARCH completedC: a5 UID FETCH 4388,4391 (FLAGS ENVELOPE)S: * 169 FETCH (UID 4388 FLAGS () ENVELOPE (...))S: * 172 FETCH (UID 4391 FLAGS () ENVELOPE (...))S: a5 OK FETCH completedC: a6 UID STORE 4388 +FLAGS (\Seen)S: * 169 FETCH (UID 4388 FLAGS (\Seen))S: a6 OK STORE completedC: a7 IDLES: + idlingS: * 173 EXISTSC: DONES: a7 OK IDLE terminatedC: a8 LOGOUTS: * BYE Logging outS: a8 OK LOGOUT completed

IMAP UIDs, UIDVALIDITY and flags

Each message has two numbers. Its sequence number is its position in the folder, and it shifts when an earlier message is expunged. Its UID is a 32-bit number assigned on arrival, higher than every UID before it and never reused, so clients cache UIDs and use the UID forms of commands.

UIDs hold only as long as the folder's UIDVALIDITY, reported on SELECT. If the server cannot keep its UIDs, because the folder was recreated or its store reordered, it must raise UIDVALIDITY, and the client empties its cache for that folder and downloads it again. UIDNEXT, the next UID to be assigned, shows whether mail has arrived.

Does deleting an email in IMAP delete it from the server?

Yes, in two steps: the client sets \Deleted, and EXPUNGE or CLOSE removes the message. Many apps move it to Trash first. In Gmail, where folders are labels, a message deleted from an IMAP folder stays in All Mail.

How does an IMAP client sync?

RFC 4549, the IETF's guide for offline clients, describes a sync in plain IMAP:

1. Replay the changes made offline.
2. Compare UIDVALIDITY with the cached value, and empty the cache if it changed.
3. Fetch new messages with UID FETCH <last UID + 1>:*.
4. Fetch FLAGS for every cached message, to catch flag changes and spot the UIDs that are gone.

Step 4 costs a line per message, in every folder, on every sync. RFC 7162 removes that cost. CONDSTORE gives each message a modification sequence that rises when its flags change, so a client asks only for what changed. QRESYNC folds the resync into SELECT, returning flag changes and, in a VANISHED line, the expunged UIDs, in one round trip:

C: a9 ENABLE QRESYNCS: * ENABLED QRESYNCS: a9 OK EnabledC: a10 SELECT INBOX (QRESYNC (1761868800 90112 4300:4392))S: * 172 EXISTSS: * OK [UIDVALIDITY 1761868800] UIDs validS: * OK [UIDNEXT 4396] Predicted next UIDS: * OK [HIGHESTMODSEQ 90260] Highest mod-sequenceS: * VANISHED (EARLIER) 4301,4350:4352S: * 118 FETCH (UID 4310 MODSEQ (90204) FLAGS (\Seen \Flagged))S: a10 OK [READ-WRITE] SELECT completed

What is IMAP IDLE?

Without IDLE, an app polls for new mail. With it, the app sends IDLE, the server answers +, and changes arrive as they happen until the app sends DONE. IDLE comes from RFC 2177 (1997) and has been part of the base protocol since IMAP4rev2.

A server may log out a client after 30 minutes or more without a command, so clients are advised to restart IDLE at least every 29 minutes. IDLE also watches only the selected folder, so an app that wants instant news of several folders keeps a connection open for each, or polls the rest with STATUS. The NOTIFY extension (RFC 5465) covers other folders, on servers that support it.

Which IMAP extensions matter?

Before MOVE, a move was copy, mark deleted and expunge, which RFC 6851 notes can stop halfway and can expunge other messages already marked. COMPRESS shrinks typical responses to 25 to 40% of their size, by RFC 4978's measure.

IMAP authentication: app passwords and OAuth

LOGIN sends a user name and password, and RFC 9051 calls it a last resort. AUTHENTICATE runs a SASL mechanism: PLAIN for a password, or an OAuth mechanism that sends a token. Google and Microsoft have switched off password sign-in, or basic authentication, for third-party apps:

Google offers "Sign in with Google", which is OAuth, or an app password: a 16-digit code for one app, which works only with 2-Step Verification on and which Google does not recommend. Outlook.com requires OAuth2.

Google and Microsoft both document XOAUTH2, which sends the address and an access token in one line, where ^A is the byte 0x01:

base64("user=" + address + "^Aauth=Bearer " + accessToken + "^A^A") C: a2 AUTHENTICATE XOAUTH2 dXNlcj1hZGFAZXhhbXBsZS5jb20BYXV0aD1CZWFyZXIgYWJjMTIzAQE=S: a2 OK Success

RFC 7628 standardised the same idea as OAUTHBEARER. In our check, Gmail, Yahoo and Fastmail announced both, and Outlook.com XOAUTH2 alone.

Gmail's IMAP needs the https://mail.google.com/ scope, which Google classes as restricted: the app must pass Google's verification, and a security assessment if its servers store or pass on the data. Microsoft's IMAP scope is https://outlook.office.com/IMAP.AccessAsUser.All.

Does Gmail still support IMAP?

Yes. Gmail's help says IMAP access is always on, and since January 2025 there is no setting to turn it off. What changed is how you sign in.

IMAP vs POP3: which should you use?

POP3, defined in RFC 1939 in 1996, fetches mail from one maildrop, and in its own words, "normally, mail is downloaded and then deleted".

Use IMAP: it is the one that keeps several devices in step. POP3 suits a device that offers nothing else, or a deliberate archive on one computer. What is JMAP? compares IMAP with JMAP, the JSON protocol meant to replace it.

Common IMAP problems and fixes

Deleted messages come back, or two apps disagree

When two apps set flags on the same message, the later one wins, unless they store with CONDSTORE's UNCHANGEDSINCE, which refuses to overwrite a change the app has not seen. Messages that reappear, or linger crossed out, often mean the apps delete differently: one marks \Deleted and waits to expunge, another moves messages to its own Trash folder.

Point every app at the server's Trash, Sent and Drafts folders rather than folders on the device. Apps that read SPECIAL-USE do this themselves, and Apple Mail has a Mailbox Behaviors pane for it.

A large mailbox is slow to sync

The first sync downloads everything the app keeps, and some providers cap it: Gmail lists 2,500 MB a day of IMAP downloads per user, and suggests syncing only folders of 10,000 messages or fewer for slow clients. Keep only recent mail or headers on the device, and prefer apps with CONDSTORE and QRESYNC, so later syncs ask only for changes.

Folders that will not appear

• Subscriptions. Some apps show only subscribed folders, so subscribe to the folder in the app.
• The path prefix. A server may keep folders under a prefix such as INBOX., and an app that ignores it nests them under Inbox or hides them. Apple Mail's IMAP Path Prefix is "the location of your mailboxes on an IMAP server", so set it to what your provider documents.
• Gmail labels. A label reaches IMAP only while Show in IMAP is ticked in Gmail's label settings.

The app cannot connect, or keeps asking for the password

Check for port 993 with SSL/TLS first. Then the sign-in: Gmail, Outlook.com and Microsoft 365 refuse the account password, so choose the app's OAuth option, or an app password where the provider offers one. If Gmail answers "Too many simultaneous connections", close other apps on the account, as it allows 15 email clients at a time.

Where Nextmail fits

Addresses on Nextmail open in mail apps over IMAP. Apple Mail, Outlook, Thunderbird and phone mail apps connect to imap.nextmail.sh on port 993 with SSL/TLS, and send through smtp.nextmail.sh on 465, or on 587 with STARTTLS. The username is the whole address, and the password is an app password made for that address on its Mail apps tab. Mail apps has the settings and a guide for each of them.

The server speaks IMAP4rev1 with IDLE, so new mail appears within about 20 seconds, CONDSTORE and QRESYNC for quick resyncs, and SPECIAL-USE, so apps find Sent, Drafts, Archive, Spam and Trash by themselves. It accepts encrypted connections only, so port 143 is not offered. Folders, sync and sending shows how folders map to labels, and Troubleshooting mail apps explains each error.

It works the other way too. A connected mailbox at Gmail, Yahoo, iCloud or another provider stays where it is: Nextmail signs in to it with an app password, or a Microsoft sign-in for Outlook, copies new mail in, usually within seconds, and sends replies through the provider. Reading, starring, archiving and deleting travel both ways, and when the same message changes in both places at once, the change made in Nextmail wins.