TCP Port 993 – IMAPS (IMAP over TLS)

Port 993 is the standard port for IMAPS, the encrypted version of the Internet Message Access Protocol. When an email client retrieves messages from a mail server using IMAPS, it connects to TCP port 993 and negotiates a TLS encrypted session before sending any credentials or message contents. Once the session is established, the client and server exchange ordinary IMAP commands inside the encrypted tunnel, hidden from anyone observing the network in between. The port is currently specified in RFC 8314 (2018), which formalized implicit TLS for mail submission and retrieval, alongside the IMAP4rev2 specification in RFC 9051 (2021).

IMAPS on port 993 is the modern default for retrieving mail. Almost every consumer mail provider (Gmail, Outlook.com, Yahoo Mail, Apple iCloud Mail) accepts IMAPS connections on port 993, and almost every modern mail client uses it by default for any account configured with IMAP retrieval. The unencrypted variant, IMAP on port 143, still exists but is increasingly disabled on internet-facing mail servers.

Two paths to encrypted IMAP exist in practice. Port 993 uses implicit TLS, where the encrypted session begins immediately on connection. Port 143 with STARTTLS uses explicit TLS, where the connection starts in plaintext and upgrades to TLS after a STARTTLS command. Both produce an encrypted session in the end; implicit TLS on 993 is more straightforward, harder to misconfigure, and is the path most modern documentation recommends.

Port 993 is also defined for UDP in the IANA registry, but only as “Reserved” with no service name assigned. UDP/993 is not used in practice.

About TCP Port 993

Port 993 is registered with the Internet Assigned Numbers Authority (IANA) for imaps. The IANA description reads: ‘IMAP over TLS protocol’.

Security Considerations

Port 993 is the recommended encrypted alternative to port 143 for retrieving mail, and the protocol itself is well-defended at the transport layer. Direct attacks against modern IMAPS servers are uncommon in our data. The 32 IDS rules referencing port 993 reflect this: every single rule in the dataset targets one specific historical vulnerability rather than ongoing attack patterns against the IMAP protocol.

That vulnerability is Heartbleed (CVE-2014-0160), the OpenSSL flaw disclosed in April 2014 that allowed attackers to read arbitrary memory contents from a vulnerable TLS endpoint. Heartbleed affected any service running OpenSSL with a vulnerable version of the heartbeat extension, which made every TLS-bearing port a potential target, including IMAPS on 993, HTTPS on 443, and many others. The IDS rules in our dataset detect both the malformed heartbeat read overrun attempts and the suspiciously large heartbeat responses that indicate a successful exploit. The flaw was patched within days of disclosure, and modern OpenSSL builds have not been vulnerable for over a decade. The rules remain useful for detecting attacks against unpatched legacy systems.

Beyond Heartbleed, the security considerations for port 993 are the standard considerations for any TLS-bearing service: keep the TLS library current, prefer modern cipher suites, ensure certificate validation is enabled on the client side, and disable plaintext fallback. The 2018 RFC 8314 specifically recommends that mail providers stop offering plaintext IMAP on port 143 and require IMAPS on port 993 for all client connections.

Port 993 traffic from end-user devices to known mail provider domains is normal and expected. Inbound port 993 to a host that does not run a mail server is uncommon. Sustained traffic on port 993 to unfamiliar destinations from a workstation, like any other encrypted-channel-to-unknown-destination signal, is worth investigating.

IDS Rule References

32 IDS / security rules reference TCP port 993. Treat that number as context, not a danger score. Many detection rules are written against groups of ports rather than one service, web ports especially, so common web alternate ports inherit large counts while genuinely sensitive services can show few rules or none. Presence in IDS rules does not mean traffic on this port is malicious.

Rule categories (top 3): attempted-recon (26), bad-unknown (5), misc-activity (1).

Sample rule descriptions for TCP port 993:

• SERVER-OTHER OpenSSL SSLv3 heartbeat read overrun attempt
• SERVER-OTHER OpenSSL TLSv1 heartbeat read overrun attempt
• SERVER-OTHER OpenSSL TLSv1.1 heartbeat read overrun attempt
• SERVER-OTHER OpenSSL TLSv1.2 heartbeat read overrun attempt
• SERVER-OTHER OpenSSL SSLv3 large heartbeat response – possible ssl heartbleed attempt

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).