TCP Port 143 – IMAP (Internet Message Access Protocol)
Port 143 is the standard port for IMAP, the Internet Message Access Protocol. IMAP is one of the two original protocols mail clients use to retrieve messages from a mail server, the other being POP3. Where POP3 was designed to download messages onto a single device and optionally remove them from the server, IMAP keeps messages on the server and lets multiple clients (a phone, a laptop, a webmail interface) access the same inbox in sync. The protocol is currently specified in RFC 9051, published in 2021, which formalizes IMAP4rev2.
IMAP on port 143 is the unencrypted variant. Modern email clients almost always use IMAPS on port 993 instead, which wraps the same protocol in a TLS encrypted session. Where port 143 is still used, it is most often within an internal network, behind a VPN, or as a starting point for a STARTTLS upgrade that switches the existing connection to encrypted before any credentials or message contents are exchanged.
The synchronized, server-side mailbox model that IMAP was designed for fits the way most people use email today, with the same inbox visible across multiple devices. As a result, IMAP has largely displaced POP3 for new deployments, and POP3 on port 110 remains supported mostly for compatibility with older clients.
Port 143 is also defined for UDP in the IANA registry, but only as “Reserved” with no service name assigned. UDP/143 is not used in practice. IMAP requires the reliable, ordered delivery and persistent connections that TCP provides.
About TCP Port 143
Port 143 carries the IANA assignment for imap. The IANA description reads: ‘Internet Message Access Protocol’.
Security Considerations
IMAP on port 143 transmits credentials and message contents in plaintext by default. A user logging in over port 143 sends their password unencrypted across the network, where any device on the path can read it. STARTTLS, an extension that upgrades a port 143 session to TLS after connecting, is widely supported and commonly used, but a misconfigured client or server can fall back to plaintext or accept a downgrade. The reliable solution is to use IMAPS on port 993 instead, which encrypts the entire session from the start.
The IDS rule activity tied to port 143 reflects a long history of server-side vulnerabilities. Our data shows 62 rules referencing this port, dominated by the misc-attack and misc-activity classtypes. The sample rules target buffer overflow attacks against legacy IMAP server implementations, including overflows in the LOGIN, AUTHENTICATE, LIST, LSUB, RENAME, and FIND command handlers, as well as in the parsing of literal-length values. Most of these flaws were discovered and patched in the late 1990s and early 2000s, but the rules remain useful for detecting attacks against unpatched legacy systems.
Common practice today is to disable plaintext IMAP on port 143 entirely on internet-facing mail servers, offering only IMAPS on port 993 to clients. Organizations that must support port 143 for compatibility typically restrict it to internal network ranges or require client connections to upgrade to TLS via STARTTLS before any sensitive data is exchanged.
Port 143 traffic across the public internet is uncommon in modern environments. Inbound IMAP to a workstation that does not run a mail server suggests either misconfiguration or an active probe.
IDS Rule References
62 IDS / security rules reference TCP port 143. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 6): misc-attack (27), misc-activity (22), attempted-admin (5), bad-unknown (3), trojan-activity (3), attempted-user (1).
Sample rule descriptions for TCP port 143:
- PROTOCOL-IMAP partial body buffer overflow attempt
- PROTOCOL-IMAP login buffer overflow attempt
- PROTOCOL-IMAP authenticate overflow attempt
- PROTOCOL-IMAP list literal overflow attempt
- PROTOCOL-IMAP lsub literal overflow attempt
Malware Activity
Some malware indicators are observed on this port.
3 of 62 IDS rules for TCP port 143 involve malware activity.
Families observed (top 1): UTF-8 (1).
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).