What Is IMAP and How Do You Access It?

What Is IMAP and How Do You Access It?

IMAP, short for Internet Message Access Protocol, keeps your mailbox on the mail server while letting your email apps work with it. Read status, folders, flags, and deletions can follow you from a phone to a laptop and then to webmail.

To connect, you normally need the mail server hostname, your full email address, the mailbox password, an encryption method, and the correct port. The details are simple once they are correct. Finding the one wrong value is where the evening disappears.

What is IMAP and how does it work?

IMAP defines the conversation between an email client and a mail server. Thunderbird, Outlook, Apple Mail, and the built-in mail apps on Android and iOS can all connect to IMAP accounts.

The useful part is that the server keeps the mailbox structure and message state. When I read a message on my phone and it appears as read on my computer a few seconds later, IMAP is doing that work.

IMAP connections should normally be protected with TLS. The IETF documents current IMAP4rev2 in RFC 9051, while many existing systems still implement IMAP4rev1 from RFC 3501. You may never see the protocol version in your mail client, and that is usually fine. During setup, choosing encrypted transport matters more than knowing the version number.

What can you do with IMAP?

• View the inbox, sent mail, drafts, and custom folders stored on the server.
• Read, search, flag, and move messages between folders.
• Synchronize read, unread, starred, and deleted states.
• Use the same mailbox from several devices.
• Download headers first and fetch message bodies or attachments when needed.

A client does not necessarily download every attachment during its first connection. With a large mailbox, the initial sync depends on the application and its cache settings. That difference matters on a laptop with limited disk space.

Small detail, big effect. I once left offline synchronization enabled for every folder on a test account and wondered why the mail client had consumed far more disk space than expected. The mailbox was not growing; the local cache was.

What is the difference between IMAP and POP3?

POP3 is built around downloading mail to a client. IMAP normally leaves the mailbox on the server and lets several clients work with the same folders and message states. POP3 can still be a reasonable choice if one computer is meant to hold a local archive, but it is less convenient when you use a phone, laptop, and webmail together.

Here is the practical difference.

Using IMAP is not the same as having a backup. If a message is deleted on the server, that change may reach every device. A full mailbox quota can also stop new mail from arriving. Archives and backups need their own policy.

SMTP and IMAP are not alternatives. SMTP handles sending; IMAP handles reading and managing the mailbox. I explain the sending side in What Is SMTP? How the Email Sending Protocol Works.

Which port does IMAP use?

Port and encryption settings are where many account setups go wrong. IANA lists 143 for IMAP and 993 for IMAPS. For a new encrypted connection, port 993 with TLS from the start is common.

Port 143 alone does not prove that a connection is unsafe. A client can connect and issue STARTTLS before sending credentials. If encryption is disabled in the client, however, the session may remain unprotected. Follow the exact connection details supplied by your hosting provider.

On port 993, the TLS handshake happens first. If the certificate name does not match the mail hostname, your client should warn you. Do not dismiss the warning just to make the account work. Check the hostname.

What information do you need to access IMAP?

When I add an IMAP account to a mail client, I collect these values first:

• IMAP server address: Usually mail.example.com, or a hostname supplied by your hosting provider.
• Username: On many hosting systems, the complete email address, such as [email protected].
• Password: The password for the mailbox. It may be different from your hosting panel password.
• Port: Usually 993 for secure IMAP.
• Encryption: SSL/TLS, or STARTTLS if the server supports it.
• Authentication: Usually normal password authentication, unless the provider documents another method.

Do not guess the server address from your website’s DNS records. Get it from your host’s email configuration screen. A website may work through www while mail is served from a completely separate hostname.

How do you add an IMAP account on a phone or computer?

Automatic setup

Gmail, Outlook, Apple Mail, and similar clients may try to discover the server settings after you enter the email address. This depends on the domain having suitable autoconfiguration records or the application recognizing the provider.

Even when automatic setup succeeds, inspect the port and encryption method. If the username is filled in as only support, replace it with the full address when your provider expects that format. Hosting servers can contain identical local usernames under different domains, so the complete address is usually the safer choice.

Manual setup

1. Open the new-account screen in your mail application.
2. Select IMAP as the account type.
3. Enter the IMAP hostname supplied by your hosting provider.
4. Use the complete email address as the username.
5. Choose port 993 and SSL/TLS.
6. In the SMTP settings, enable authentication with the same username and password when required.
7. Let the client finish its test connection.

It is easy to mix up SMTP and IMAP here. The incoming server is IMAP; the outgoing server is SMTP. They may use the same hostname, but the protocols and ports are different.

If receiving works but sending does not, changing only the IMAP settings will not fix it. I have made that mistake during a hurried account setup: the inbox was healthy, while the outgoing server was still configured with an old port. Separate the two tests.

How can you test an IMAP connection from a Linux terminal?

When a mail client reports an error, I do not start by changing the password. I test DNS and the TLS handshake separately so I can tell whether the problem is the network, certificate, or authentication.

dig +short mail.example.com

The command should return an IP address. If it returns nothing, inspect DNS before testing IMAP. The +short flag keeps the output readable.

Check a TLS connection on port 993 with OpenSSL:

openssl s_client -connect mail.example.com:993 -servername mail.example.com -crlf

The output includes the certificate chain, validity dates, and hostname information. A line such as Verify return code: 0 (ok) means OpenSSL verified the certificate successfully. Another code can point to a broken chain, an expired certificate, or a name mismatch.

The -servername option matters when the server hosts several names on one address. I once left it out while testing a shared mail service and blamed the certificate because the server returned the wrong virtual-host certificate. The server was fine. My test was incomplete.

After the TLS session opens, you can see the server greeting. IMAP commands use a client-chosen tag:

A001 CAPABILITY
A002 LOGOUT

The A001 and A002 tags let the client match responses to requests. CAPABILITY lists features supported by the server. Do not type a real mailbox password into your shell history. If authentication testing is necessary, use a controlled account and follow your provider’s security policy.

To test STARTTLS on port 143, use:

openssl s_client -connect mail.example.com:143 -starttls imap -crlf

Here TLS is enabled after the STARTTLS negotiation. If the server does not support STARTTLS, this test will fail even if port 143 accepts connections. Testing both methods makes the client’s SSL/TLS and STARTTLS options much less mysterious.

Why does an IMAP connection fail?

Wrong server name or DNS record

The domain’s main A record can be correct while the mail hostname points somewhere else. Verify the expected address with dig +short. If an AAAA record exists, a client may try IPv6 first. A broken IPv6 service can produce failures that appear only on some networks.

This is also where DNS and email overlap. The checks in How to Fix DNS_PROBE_FINISHED_NXDOMAIN Error are useful when a mail hostname does not resolve.

Port blocked by a firewall

On a VPS, having the mail daemon running is not enough. The operating system firewall and your provider’s network rules must also allow the connection. If the server is yours, check listening ports with:

sudo ss -ltnp | grep -E ':(143|993)'

A LISTEN line means a process is listening on that port. If there is no such line, check Dovecot or the mail server you use before changing firewall rules. Changing the port at random is not troubleshooting.

Certificate name mismatch

If the client uses mail.example.com but the certificate was issued only for server.provider.net, it may display a warning. Accepting that warning does not repair the configuration. Ask the provider for the correct hostname or issue a certificate for the name used by the mail client.

Incorrect username format

Many hosting systems require the full email address as the username. Try [email protected] instead of just user. Corporate mail systems may use another identity format, so follow the server documentation rather than assuming one format works everywhere.

Mailbox quota is full

If the account connects but new messages do not appear, check the quota and folder sizes. Some systems do not immediately empty the Trash folder. Start by reviewing large messages and old folders instead of raising the quota without checking disk usage.

How do you use IMAP safely?

• Prefer 993/TLS when possible; if you use port 143, verify that STARTTLS is enabled.
• Do not reuse the mailbox password for the web panel, FTP, or unrelated services without a good reason.
• Monitor failed logins in the server logs and apply protections such as fail2ban where appropriate.
• Set a mailbox quota. A full disk can affect more than email.
• Keep backups separate from IMAP synchronization.
• Protect passwords saved in third-party clients with the device’s screen lock.

If you run Dovecot, look for authentication, TLS, and connection errors separately in its logs. A generic connection failed message does not distinguish a certificate problem from a bad password.

I once changed a mailbox password after looking only at the client’s vague error dialog. The logs and TLS output told a different story, and the password change only added another variable to the test.

IMAP folders and synchronization behavior

Clients do not always display folder names in the same way. A server folder called Sent may appear as “Sent Mail” or a localized equivalent. Some clients need explicit mappings for drafts, sent mail, and trash. A message in an unexpected folder is not necessarily missing; the subscription or special-folder mapping may be wrong.

Deletion in IMAP can also happen in two stages. The client first marks a message as deleted, then removes it permanently during an expunge operation. This matters when you investigate storage usage. Emptying the inbox does not necessarily remove messages from the Trash folder.

With a large mailbox, you may not want every folder synchronized for offline use. Select the folders that should be downloaded, limit automatic attachment downloads, and watch the local cache size. If you are investigating storage rather than network usage, the relevant limit is mailbox quota and disk space, not the bandwidth calculations discussed in VPS Bandwidth Explained: How Much Do You Need.

A practical order for checking IMAP problems

1. Confirm the mail hostname in your provider’s panel.
2. Use dig +short to verify that the hostname resolves.
3. Test TLS on 993 or STARTTLS on 143 with OpenSSL.
4. Try the full email address as the username.
5. Compare the port, encryption, and authentication choices with the server settings.
6. Check that the server and client clocks are correct; certificate validation can be affected by an incorrect time.
7. Inspect the mailbox quota and the relevant service logs.

This order keeps you from getting stuck on the “wrong password” theory. Change one variable at a time during a connection test. If you change the hostname, port, and password together, you will not know which change fixed the problem.

Start with the name. Then DNS. Then TLS. It is a less exciting sequence than changing passwords at random, but it leaves you with evidence.

Frequently asked questions about IMAP

Does using IMAP cost extra?

The IMAP protocol itself does not normally carry a separate fee. Your hosting or email provider sets the price according to its storage, user, and traffic policies.

Are emails downloaded to a computer when I use IMAP?

A client may keep a local cache for faster viewing and offline access. The primary mailbox is usually on the server, and that cache should not be treated as a backup.

Should you use port 143 or 993 for IMAP?

If the server supports it, port 993 with TLS from the beginning is usually the simpler choice. Port 143 can also be encrypted with STARTTLS, but make sure encryption is enabled in the client.

Why does my IMAP password keep appearing to be wrong?

An incorrect username format, wrong server name, certificate problem, locked account, or full quota can all lead to a misleading login error. Try the full email address, test TLS, and check the server logs for the real cause.

When I troubleshoot IMAP, I start with the hostname, DNS, and TLS rather than attacking the password. If those three are clean, authentication usually takes much less time.

Sources

• IETF RFC 9051 – Internet Message Access Protocol Version 4rev2 — rfc-editor.org
• IANA – Service Name and Transport Protocol Port Number Registry — iana.org