Port 143: Internet Message Access Protocol
TCP port 143 is the cleartext port for the Internet Message Access Protocol (IMAP). RFC 9051 states that an IMAP4rev2 server listens on port 143, or on port 993 for implicit TLS. Mail clients use IMAP to read and manage mailboxes that stay on the server.
Port Details
Security Exposure
A session on port 143 starts unencrypted, so credentials are exposed unless STARTTLS is negotiated before login. Basic password authentication over IMAP makes credentials easier to capture, which led Microsoft to remove Basic authentication for IMAP and POP in Exchange Online. MITRE ATT&CK notes that password spraying also targets externally facing email applications.
Hardening
- +Prefer implicit TLS on port 993, as RFC 8314 recommends, and close port 143 if no client needs it.
- +If port 143 stays open, advertise LOGINDISABLED until STARTTLS completes, as RFC 9051 requires implementations to support.
- +Use OAuth 2.0 or other modern authentication instead of plain passwords where supported.
- +Rate-limit or lock out repeated login failures.
Monitoring
Log IMAP logins with source address and authentication method. Alert on logins made without TLS and on many failed logins spread across different accounts.
Tools for Auditing and Monitoring IMAP
Hydra
Open SourceParallelized network login auditing tool that tests dozens of remote authentication protocols including SSH, SMB, RDP, HTTP, and database services.
Nmap
Free / CommercialNetwork discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.
Zeek
Open SourceNetwork security monitoring framework that translates raw packet traffic into structured transaction logs and network events.
Related Tool Categories
Frequently Asked Questions
What is the difference between port 143 and port 993?→
Port 143 is the cleartext IMAP port, where TLS can be added with STARTTLS. Port 993 starts TLS immediately (implicit TLS), which RFC 8314 recommends for mail access.
Is IMAP TCP or UDP?→
IMAP uses TCP. IANA registers port 143 for TCP only and marks UDP 143 as reserved.
Sources
- IANA Service Name and Transport Protocol Port Number Registry (port 143)
- RFC 9051: Internet Message Access Protocol (IMAP) Version 4rev2
- RFC 8314: Cleartext Considered Obsolete: Use of TLS for Email Submission and Access
- Microsoft Learn: Deprecation of Basic authentication in Exchange Online
- MITRE ATT&CK T1110.003: Brute Force, Password Spraying
Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 143 is not guaranteed to be IMAP. Exploited-in-the-wild data from the CISA KEV catalog (CC0).