Short answer: IMAP uses port 143 unencrypted or with STARTTLS, and 993 for IMAP over TLS from the start (IMAPS). POP3 uses port 110 unencrypted or with STARTTLS, and 995 for POP3 over TLS from the start (POP3S). The practical difference between the two protocols matters more than the ports: IMAP keeps your mail on the server and syncs read/unread state and folders across every device; POP3 downloads messages to one client and, by its original design, deletes them from the server afterwards.
| Protocol | Port | Encryption | /etc/services name |
|---|---|---|---|
| IMAP | 143 | None, or upgraded in-session with STARTTLS | imap2 |
| IMAPS | 993 | TLS from the first byte (implicit TLS) | imaps |
| POP3 | 110 | None, or upgraded in-session with STARTTLS | pop3 |
| POP3S | 995 | TLS from the first byte (implicit TLS) | pop3s |
These four are registered with IANA and have not changed in decades; on any Linux box they are also right there in /etc/services:
| Line | Meaning |
|---|---|
pop3 110/tcp pop-3 | POP3, plaintext or STARTTLS |
imap2 143/tcp imap | IMAP, plaintext or STARTTLS — the name imap2 is historical, the protocol is current IMAP4rev2 |
imaps 993/tcp | IMAP over TLS from the start |
pop3s 995/tcp | POP3 over TLS from the start |
IMAP vs POP3: what actually differs
- Where the mail lives. IMAP treats the server as the source of truth: messages, folders, flags (read, flagged, replied-to) all live there, and every client — phone, webmail, desktop — sees the same state. POP3 was designed around a single client downloading mail to local storage; by default it removes the message from the server once downloaded, so a second device sees nothing of what the first already took.
- Multiple devices. This is the deciding factor for almost everyone today. Check mail on a phone and a laptop and expect both to show the same inbox? That is IMAP’s job description. Most POP3 clients now offer a “leave a copy on the server” setting that papers over the multi-device case, but folders and read/unread state still do not sync — each client manages its own local copy independently.
- Server storage. IMAP keeps everything on the server indefinitely unless you delete it, which means server disk usage grows with your mailbox. POP3, used in its original download-and-delete mode, keeps the server’s footprint small — one reason it still shows up on storage-constrained setups.
- Offline access. A POP3 client always has a full local copy once downloaded. An IMAP client needs its own caching/offline mode to read mail without a connection — standard in every mainstream client today, but worth knowing it is the client doing that, not the protocol.
STARTTLS vs the dedicated TLS ports
Ports 143 and 110 are not inherently insecure — both support STARTTLS, where the client connects in plaintext and then upgrades the same connection to TLS before sending any credentials. Ports 993 and 995 skip that negotiation: the TLS handshake happens as soon as the connection opens, before any mail protocol commands are exchanged at all (the same implicit-vs-explicit distinction that separates HTTPS on 443 from HTTP upgraded withUpgrade: TLS). In practice almost every mail client and server defaults to the dedicated TLS ports now; STARTTLS on 143/110 mainly survives for compatibility with older configurations and for SMTP’s own port 587, which works the same way.
Opening the ports
If you run your own mail server rather than using a managed one, open what you serve:
| Service | Command |
|---|---|
| SMTP (incoming mail) | sudo ufw allow 25/tcp |
| Submission (authenticated sending) | sudo ufw allow 587/tcp |
| IMAPS | sudo ufw allow 993/tcp |
| POP3S | sudo ufw allow 995/tcp |
Skip opening plain 143 and 110 entirely unless something you cannot change still needs STARTTLS on the unencrypted port — there is no reason to expose them otherwise. See setting up ufw for the firewall basics, and SMTP ports 25, 465 and 587 for the sending side of the same mail server, which these ports are usually opened alongside.
A port that answers but a client that still fails
A client that cannot connect at all points at the firewall or the wrong port; a client that connects but then fails to log in or sync almost always points elsewhere — DNS (the hostname the client is configured with has to resolve and match the certificate), the certificate itself, or the account credentials. telnet HOST 993 will not get far past the initial TCP connection, since 993 expects TLS immediately; openssl s_client -connect HOST:993 is the right tool to actually see the IMAP greeting banner once TLS is up.
For the general list of ports a server commonly needs open at all, common ports and what runs on them covers mail alongside web, SSH and database ports in one table, and FTP’s ports if file transfer is the next thing on the list.
Frequently asked
What port does IMAP use?
143 for plain IMAP, which can upgrade to TLS in-session with STARTTLS, or 993 for IMAP over TLS from the first byte (IMAPS). Almost every current client and server defaults to 993.
What port does POP3 use?
110 for plain POP3, or 995 for POP3 over TLS from the first byte (POP3S) — the same plaintext-vs-implicit-TLS split as IMAP's two ports.
What is the real difference between IMAP and POP3?
IMAP keeps mail, folders and read/unread state on the server, so every device sees the same inbox. POP3 was designed around one client downloading mail and, by default, removing it from the server afterwards — a second device then sees nothing of what the first already took, even though most clients now offer a setting to leave a copy behind.
Should I use STARTTLS or the dedicated TLS port?
The dedicated port (993 for IMAP, 995 for POP3) when you have the choice — the TLS handshake happens immediately, before any protocol commands or credentials are exchanged, with no negotiation step that could be downgraded or fail silently.