---
title: "What is IMAP? How IMAP works: ports, sync and security"
description: "IMAP is how mail apps read and organise mail that stays on the server, in sync on every device. How it works, which port to use and how it compares with POP3."
url: "https://nextmail.sh/blog/what-is-imap"
---

[Blog](https://nextmail.sh/blog.md)[Protocols](https://nextmail.sh/blog/tags/protocols.md)

# What is IMAP? How IMAP works: ports, sync and security

IMAP is how mail apps read and organise mail that stays on the server, in sync on every device. How it works, which port to use and how it compares with POP3.

Arta Nextmail team

October 31, 2026 10 min read

TL;DR

- IMAP, the Internet Message Access Protocol, lets a mail app read and organise mail that stays on the server, so every device shows the same folders, read state and flags.
- Its current version is IMAP4rev2, published as RFC 9051 in 2021, but Gmail, Outlook.com, iCloud and Yahoo still announce IMAP4rev1 and rely on extensions for features such as push.
- Connect on port 993, where TLS starts before any IMAP is sent, and sign in with OAuth or an app password, because Google and Microsoft have turned off sign-in with the account password alone.

IMAP, the Internet Message Access Protocol, is how a mail app reads mail that lives on a server. The messages stay put and the app keeps a copy, so a message you read or file on your phone is read or filed on your laptop too.

## What is IMAP used for?

IMAP is for working with mail that stays on a server. RFC 9051 describes it as handling "remote message folders" in a way that is functionally equivalent to local ones: a client can create folders, search on the server, fetch a whole message or one part of it, set flags and move messages. Because the server holds the mailbox, any number of devices can use it at once.

### What is the difference between IMAP and SMTP?

IMAP reads mail that has already arrived. Sending is SMTP's job, on port 465 or 587, so a mail app usually speaks both. [What is SMTP?](https://nextmail.sh/blog/what-is-smtp.md) covers the sending side, and [What is an email client?](https://nextmail.sh/blog/what-is-an-email-client.md) shows how apps combine the two.

## IMAP versions, from IMAP2 to IMAP4rev2

Mark Crispin published IMAP2, the first IMAP RFC, as RFC 1064 in July 1988, when the letters stood for Interactive Mail Access Protocol.

| Version | Specification | Published |
| --- | --- | --- |
| IMAP2 | RFC 1064 | July 1988 |
| IMAP4 | RFC 1730 | December 1994 |
| IMAP4rev1 | RFC 2060, then RFC 3501 | December 1996, March 2003 |
| IMAP4rev2 | RFC 9051 | August 2021 |

RFC 9051 obsoletes RFC 3501 and folds twelve extensions into the base protocol: NAMESPACE, UNSELECT, UIDPLUS, ESEARCH, SEARCHRES, ENABLE, IDLE, SASL-IR, LIST-EXTENDED, LIST-STATUS, MOVE and LITERAL-, along with the SPECIAL-USE folder attributes. CONDSTORE and QRESYNC, which make resyncing fast, stayed optional, so as not to set the bar too high for new implementations.

RFC 9051 lets a server announce both versions. When we sent `CAPABILITY` to five providers on 31 October 2026, Gmail, Outlook.com, iCloud and Yahoo announced IMAP4rev1 but not IMAP4rev2, and Fastmail announced both.

## What port does IMAP use?

IMAP uses port 993 or port 143:

| Port | How the connection is protected |
| --- | --- |
| 993 | Implicit TLS: the TLS handshake comes first, and IMAP runs inside it |
| 143 | Plain text, upgraded with the `STARTTLS` command |

Use 993. RFC 8314, "Cleartext Considered Obsolete" (2018), recommends implicit TLS over STARTTLS for reading and sending mail. Its authors, one of whom wrote RFC 2595, the STARTTLS standard for IMAP and POP, now say that approach was a mistake: a separate port is simpler, and STARTTLS led several implementers to the same command injection bug. A 2021 USENIX Security study reported more than 40 STARTTLS issues, and found only 3 of 28 mail clients free of them. Gmail ([`imap.gmail.com`](https://developers.google.com/workspace/gmail/imap/imap-smtp)) and Outlook.com ([`outlook.office365.com`](https://support.microsoft.com/en-us/outlook/pop-imap-and-smtp-settings-for-outlook-com)) both serve IMAP on 993.

### Is IMAP secure?

On port 993, yes: the whole session is encrypted, the password included. On 143 without STARTTLS the password travels in plain text, and RFC 9051 tells clients never to use `LOGIN` there. The weak point now is the password: Microsoft notes that multifactor authentication is hard to enforce while password sign-in stays on, one reason providers moved to [OAuth](https://nextmail.sh/blog/what-is-imap#imap-authentication-app-passwords-and-oauth).

## How does IMAP work?

An IMAP session is one long-lived connection carrying lines of text. The client starts each command with a tag, such as `a1`. The server replies with untagged lines starting with `*`, then a line that repeats the tag and says `OK`, `NO` or `BAD`. A `+` asks the client to continue. Untagged lines can also arrive unasked, which is how new mail is reported.

A session moves through four states: not authenticated, authenticated, selected and logout. Here is one on port 993, after the TLS handshake, with `C:` for the client and `S:` for the server:

txt

```
S: * OK IMAP server readyC: a1 CAPABILITYS: * CAPABILITY IMAP4rev1 SASL-IR AUTH=PLAIN AUTH=XOAUTH2 IDLE MOVE SPECIAL-USES: a1 OK CAPABILITY completedC: a2 AUTHENTICATE PLAIN AGFkYUBleGFtcGxlLmNvbQBhcHAtcGFzc3dvcmQ=S: a2 OK Logged inC: a3 SELECT INBOXS: * 172 EXISTSS: * FLAGS (\Answered \Flagged \Deleted \Seen \Draft)S: * OK [UIDVALIDITY 1761868800] UIDs validS: * OK [UIDNEXT 4392] Predicted next UIDS: a3 OK [READ-WRITE] SELECT completedC: a4 UID SEARCH UNSEENS: * SEARCH 4388 4391S: a4 OK SEARCH completedC: a5 UID FETCH 4388,4391 (FLAGS ENVELOPE)S: * 169 FETCH (UID 4388 FLAGS () ENVELOPE (...))S: * 172 FETCH (UID 4391 FLAGS () ENVELOPE (...))S: a5 OK FETCH completedC: a6 UID STORE 4388 +FLAGS (\Seen)S: * 169 FETCH (UID 4388 FLAGS (\Seen))S: a6 OK STORE completedC: a7 IDLES: + idlingS: * 173 EXISTSC: DONES: a7 OK IDLE terminatedC: a8 LOGOUTS: * BYE Logging outS: a8 OK LOGOUT completed
```

| Command | What it does |
| --- | --- |
| `CAPABILITY` | Lists the server's sign-in methods and extensions |
| `AUTHENTICATE PLAIN` | Signs in with the address and password in base64, on one line thanks to SASL-IR |
| `SELECT` | Opens a folder and reports its message count, flags and UID values |
| `UID SEARCH` | Searches on the server. IMAP4rev2 answers with an `ESEARCH` line |
| `UID FETCH` | Fetches only the parts asked for, here flags and the envelope |
| `UID STORE` | Changes flags, here marking a message read |
| `IDLE` | Waits while the server pushes changes, such as `173 EXISTS`, until `DONE` |
| `LOGOUT` | Ends the session |

## IMAP UIDs, UIDVALIDITY and flags

Each message has two numbers. Its sequence number is its position in the folder, and it shifts when an earlier message is expunged. Its UID is a 32-bit number assigned on arrival, higher than every UID before it and never reused, so clients cache UIDs and use the `UID` forms of commands.

UIDs hold only as long as the folder's UIDVALIDITY, reported on `SELECT`. If the server cannot keep its UIDs, because the folder was recreated or its store reordered, it must raise UIDVALIDITY, and the client empties its cache for that folder and downloads it again. UIDNEXT, the next UID to be assigned, shows whether mail has arrived.

| Flag | Meaning |
| --- | --- |
| `\Seen` | Read |
| `\Answered` | Replied to |
| `\Flagged` | Flagged for attention |
| `\Deleted` | To be removed at the next expunge |
| `\Draft` | A draft |

### Does deleting an email in IMAP delete it from the server?

Yes, in two steps: the client sets `\Deleted`, and `EXPUNGE` or `CLOSE` removes the message. Many apps move it to Trash first. In Gmail, where folders are labels, [a message deleted from an IMAP folder stays in All Mail](https://support.google.com/mail/answer/78892).

## How does an IMAP client sync?

RFC 4549, the IETF's guide for offline clients, describes a sync in plain IMAP:

1. Replay the changes made offline.
2. Compare UIDVALIDITY with the cached value, and empty the cache if it changed.
3. Fetch new messages with `UID FETCH <last UID + 1>:*`.
4. Fetch `FLAGS` for every cached message, to catch flag changes and spot the UIDs that are gone.

Step 4 costs a line per message, in every folder, on every sync. RFC 7162 removes that cost. CONDSTORE gives each message a modification sequence that rises when its flags change, so a client asks only for what changed. QRESYNC folds the resync into `SELECT`, returning flag changes and, in a `VANISHED` line, the expunged UIDs, in one round trip:

txt

```
C: a9 ENABLE QRESYNCS: * ENABLED QRESYNCS: a9 OK EnabledC: a10 SELECT INBOX (QRESYNC (1761868800 90112 4300:4392))S: * 172 EXISTSS: * OK [UIDVALIDITY 1761868800] UIDs validS: * OK [UIDNEXT 4396] Predicted next UIDS: * OK [HIGHESTMODSEQ 90260] Highest mod-sequenceS: * VANISHED (EARLIER) 4301,4350:4352S: * 118 FETCH (UID 4310 MODSEQ (90204) FLAGS (\Seen \Flagged))S: a10 OK [READ-WRITE] SELECT completed
```

## What is IMAP IDLE?

Without IDLE, an app polls for new mail. With it, the app sends `IDLE`, the server answers `+`, and changes arrive as they happen until the app sends `DONE`. IDLE comes from RFC 2177 (1997) and has been part of the base protocol since IMAP4rev2.

A server may log out a client after 30 minutes or more without a command, so clients are advised to restart IDLE at least every 29 minutes. IDLE also watches only the selected folder, so an app that wants instant news of several folders keeps a connection open for each, or polls the rest with `STATUS`. The NOTIFY extension (RFC 5465) covers other folders, on servers that support it.

## Which IMAP extensions matter?

| Extension | RFC | What it gives a client | In IMAP4rev2 |
| --- | --- | --- | --- |
| `IDLE` | 2177 | Pushed changes for the selected folder | Built in |
| `CONDSTORE`, `QRESYNC` | 7162 | Only what changed since the last sync | Recommended |
| `MOVE` | 6851 | A move in one command | Built in |
| `SPECIAL-USE` | 6154 | Which folders are Sent, Drafts, Trash, Junk and Archive | Attributes built in |
| `COMPRESS=DEFLATE` | 4978 | A compressed connection | Not included |

Before MOVE, a move was copy, mark deleted and expunge, which RFC 6851 notes can stop halfway and can expunge other messages already marked. COMPRESS shrinks typical responses to 25 to 40% of their size, by RFC 4978's measure.

## IMAP authentication: app passwords and OAuth

`LOGIN` sends a user name and password, and RFC 9051 calls it a last resort. `AUTHENTICATE` runs a SASL mechanism: `PLAIN` for a password, or an OAuth mechanism that sends a token. Google and Microsoft have switched off password sign-in, or basic authentication, for third-party apps:

| Provider | What changed | When |
| --- | --- | --- |
| Microsoft 365 (Exchange Online) | Basic authentication off for IMAP and POP, for good since the end of 2022 | From 1 October 2022 |
| Outlook.com | Basic authentication stopped working | 16 September 2024 |
| Google Workspace | IMAP, POP, SMTP, CalDAV and CardDAV stopped accepting legacy passwords | 14 March 2025 |

Google offers "Sign in with Google", which is OAuth, or an [app password](https://support.google.com/accounts/answer/185833): a 16-digit code for one app, which works only with 2-Step Verification on and which Google does not recommend. Outlook.com requires OAuth2.

Google and Microsoft both document XOAUTH2, which sends the address and an access token in one line, where `^A` is the byte 0x01:

txt

```
base64("user=" + address + "^Aauth=Bearer " + accessToken + "^A^A") C: a2 AUTHENTICATE XOAUTH2 dXNlcj1hZGFAZXhhbXBsZS5jb20BYXV0aD1CZWFyZXIgYWJjMTIzAQE=S: a2 OK Success
```

RFC 7628 standardised the same idea as OAUTHBEARER. In our check, Gmail, Yahoo and Fastmail announced both, and Outlook.com XOAUTH2 alone.

Gmail's IMAP needs the `https://mail.google.com/` scope, which Google classes as [restricted](https://developers.google.com/workspace/gmail/api/auth/scopes): the app must pass Google's verification, and a security assessment if its servers store or pass on the data. Microsoft's IMAP scope is [`https://outlook.office.com/IMAP.AccessAsUser.All`](https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth).

### Does Gmail still support IMAP?

Yes. [Gmail's help](https://support.google.com/mail/answer/7126229) says IMAP access is always on, and since January 2025 there is no setting to turn it off. What changed is how you sign in.

## IMAP vs POP3: which should you use?

POP3, defined in RFC 1939 in 1996, fetches mail from one maildrop, and in its own words, "normally, mail is downloaded and then deleted".

|  | IMAP | POP3 |
| --- | --- | --- |
| Where mail lives | On the server | On the device that downloaded it |
| Folders | Any number, on the server | One maildrop, usually the inbox |
| Read and flagged state | Shared by every app | Kept by each app |
| New mail | Pushed with IDLE | Checked on a schedule |
| Search | On the server | In the app, after downloading |
| Ports | 993, or 143 with STARTTLS | 995, or 110 |

Use IMAP: it is the one that keeps several devices in step. POP3 suits a device that offers nothing else, or a deliberate archive on one computer. [What is JMAP?](https://nextmail.sh/blog/what-is-jmap.md) compares IMAP with JMAP, the JSON protocol meant to replace it.

## Common IMAP problems and fixes

### Deleted messages come back, or two apps disagree

When two apps set flags on the same message, the later one wins, unless they store with CONDSTORE's `UNCHANGEDSINCE`, which refuses to overwrite a change the app has not seen. Messages that reappear, or linger crossed out, often mean the apps delete differently: one marks `\Deleted` and waits to expunge, another moves messages to its own Trash folder.

Point every app at the server's Trash, Sent and Drafts folders rather than folders on the device. Apps that read SPECIAL-USE do this themselves, and Apple Mail has a [Mailbox Behaviors](https://support.apple.com/guide/mail/change-mailbox-behaviors-settings-cpmlprefacctmbox/mac) pane for it.

### A large mailbox is slow to sync

The first sync downloads everything the app keeps, and some providers cap it: Gmail lists [2,500 MB a day of IMAP downloads](https://knowledge.workspace.google.com/admin/gmail/gmail-bandwidth-limits) per user, and suggests syncing only folders of 10,000 messages or fewer for slow clients. Keep only recent mail or headers on the device, and prefer apps with CONDSTORE and QRESYNC, so later syncs ask only for changes.

### Folders that will not appear

- **Subscriptions.** Some apps show only subscribed folders, so subscribe to the folder in the app.
- **The path prefix.** A server may keep folders under a prefix such as `INBOX.`, and an app that ignores it nests them under Inbox or hides them. Apple Mail's [IMAP Path Prefix](https://support.apple.com/guide/mail/change-server-settings-cpmlprefacctadv/mac) is "the location of your mailboxes on an IMAP server", so set it to what your provider documents.
- **Gmail labels.** A label reaches IMAP only while [Show in IMAP](https://support.microsoft.com/en-us/outlook/how-to-show-or-hide-folders-for-imap-in-google-settings) is ticked in Gmail's label settings.

### The app cannot connect, or keeps asking for the password

Check for port 993 with SSL/TLS first. Then the sign-in: Gmail, Outlook.com and Microsoft 365 refuse the account password, so choose the app's OAuth option, or an app password where the provider offers one. If Gmail answers "Too many simultaneous connections", close other apps on the account, as it allows 15 email clients at a time.

## Where Nextmail fits

Addresses on Nextmail open in mail apps over IMAP. Apple Mail, Outlook, Thunderbird and phone mail apps connect to `imap.nextmail.sh` on port 993 with SSL/TLS, and send through `smtp.nextmail.sh` on 465, or on 587 with STARTTLS. The username is the whole address, and the password is an app password made for that address on its Mail apps tab. [Mail apps](https://nextmail.sh/docs/knowledge/addresses/mail-apps.md) has the settings and a guide for each of them.

The server speaks IMAP4rev1 with IDLE, so new mail appears within about 20 seconds, CONDSTORE and QRESYNC for quick resyncs, and SPECIAL-USE, so apps find Sent, Drafts, Archive, Spam and Trash by themselves. It accepts encrypted connections only, so port 143 is not offered. [Folders, sync and sending](https://nextmail.sh/docs/knowledge/addresses/mail-apps/sync.md) shows how folders map to labels, and [Troubleshooting mail apps](https://nextmail.sh/docs/knowledge/addresses/mail-apps/troubleshooting.md) explains each error.

It works the other way too. A [connected mailbox](https://nextmail.sh/docs/knowledge/addresses/connected-mailboxes.md) at Gmail, Yahoo, iCloud or another provider stays where it is: Nextmail signs in to it with an app password, or a Microsoft sign-in for Outlook, copies new mail in, usually within seconds, and sends replies through the provider. Reading, starring, archiving and deleting travel both ways, and when the same message changes in both places at once, the change made in Nextmail wins.

- [Protocols](https://nextmail.sh/blog/tags/protocols.md)
- [Email clients](https://nextmail.sh/blog/tags/email-clients.md)
- [Developers](https://nextmail.sh/blog/tags/developers.md)

## References

1. 1 [RFC 9051: Internet Message Access Protocol (IMAP), Version 4rev2](https://www.rfc-editor.org/rfc/rfc9051) IETF
2. 2 [RFC 8314: Cleartext Considered Obsolete: Use of Transport Layer Security (TLS) for Email Submission and Access](https://www.rfc-editor.org/rfc/rfc8314) IETF
3. 3 [RFC 7162: IMAP Extensions: Quick Flag Changes Resynchronization (CONDSTORE) and Quick Mailbox Resynchronization (QRESYNC)](https://www.rfc-editor.org/rfc/rfc7162) IETF
4. 4 [RFC 4549: Synchronization Operations for Disconnected IMAP4 Clients](https://www.rfc-editor.org/rfc/rfc4549) IETF
5. 5 [RFC 1939: Post Office Protocol, Version 3](https://www.rfc-editor.org/rfc/rfc1939) IETF
6. 6 [Why TLS is better without STARTTLS: A Security Analysis of STARTTLS in the Email Context](https://www.usenix.org/conference/usenixsecurity21/presentation/poddebniak) USENIX
7. 7 [Transition from less secure apps to OAuth](https://knowledge.workspace.google.com/admin/sync/transition-from-less-secure-apps-to-oauth) Google
8. 8 [OAuth 2.0 mechanism](https://developers.google.com/workspace/gmail/imap/xoauth2-protocol) Google
9. 9 [Deprecation of Basic authentication in Exchange Online](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online) Microsoft
10. 10 [Modern Authentication Methods now needed to continue syncing Outlook Email in non-Microsoft email apps](https://support.microsoft.com/en-US/support/known-issues/modern-authentication-methods-now-needed-to-continue-syncing-outlook-email-in-non-microsoft-email-ap) Microsoft

Keep reading

## Related articles

Oct 31, 2026 10 min read

### What is SMTP? How it works, from ports to reply codes

SMTP is the protocol that carries email from your app to your provider and between mail servers. How it works, which port to use and what each reply means.

Benjamin Protocols

Oct 31, 2026 6 min read

### What is JMAP? The JSON email protocol, explained

JMAP is the IETF standard for email, contacts and calendars over JSON and HTTPS. How it works, how it differs from IMAP, and who supports it in 2026.

Arta Developers

Oct 31, 2026 9 min read

### What is an email client? How email clients work

An email client is the app you read and send mail in, apart from the service that holds your mailbox. How clients find servers, sync, send and guard privacy.

Benjamin Email clients

Try it yourself

## Your email, on your own domain.

Nextmail puts your domains, sending and inbox in one place, with the full API on every plan, the free one included.

[Open mail](https://nextmail.sh/mail/inbox) [Get Started](https://nextmail.sh/signup.md)[All articles](https://nextmail.sh/blog.md)