IMAP
The Internet Message Access Protocol (IMAP) is the standard Internet protocol for accessing and manipulating electronic mail stored on a remote server. Unlike pop3, which downloads and (typically) deletes mail from the server, IMAP is designed for online access — messages stay on the server and the client manipulates mailboxes in place. This makes IMAP the dominant protocol for modern multi-device email access.
IMAP was first specified in RFC 3501 (IMAP4rev1, March 2003) and was revised by RFC 9051 (IMAP4rev2, August 2021). It runs over TCP port 143 (cleartext / STARTTLS) and port 993 (implicit TLS, IMAPS).
Core commands
IMAP commands are tagged with a client-supplied prefix so replies can be matched to requests. The simplest authentication is LOGIN (plaintext credentials — prefer AUTHENTICATE with SASL or TLS in practice). Essential commands:
| Command | Purpose |
|---|---|
LOGIN user pass | Authenticate with username/password |
LIST "" "*" | List all mailboxes/folders |
EXAMINE INBOX | Open mailbox read-only and return message count |
SELECT INBOX | Open mailbox read-write |
FETCH | Retrieve message content/flags |
STORE | Modify message flags |
LOGOUT | Close connection |
IMAP supports far richer operations than POP3: server-side search, multiple simultaneous mailbox access, message flags (read, flagged, deleted), and partial message retrieval.
Security notes
- Cleartext credentials —
LOGINsends credentials in the clear on port 143; always use STARTTLS or IMAPS (port 993). - User enumeration — Some servers return different responses for valid vs. invalid usernames, aiding account enumeration.
- IMAPS vs STARTTLS — Port 993 wraps the session in TLS immediately; port 143 upgrades via
STARTTLS. Both are acceptable; unencrypted port 143 is not.
Related: smtp (mail transmission), pop3 (offline mail retrieval), openssl-s-client-command-injection (TLS-wrapped service testing).
Sources
- RFC 3501 — Internet Message Access Protocol Version 4rev1
- RFC 9051 — Internet Message Access Protocol (IMAP) Version 4rev2