IMAP vs POP3 Explained: Ports 143, 993, 110 and 995 for Network+

IMAP — Internet Message Access Protocol — retrieves email from a mail server while leaving it there, keeping every device you own in sync. It is the protocol behind the fact that reading a message on your phone marks it read on your laptop.

IMAP synchronizes. POP3 downloads. That one sentence answers most exam questions on this topic.

And remember the direction: SMTP sends mail; IMAP and POP3 retrieve it. Confusing sending with receiving is the other common error.

IMAP Versus POP3

	IMAP	POP3
Where mail lives	On the server	Downloaded to the client
Multiple devices	Fully synchronized	Poorly — each device gets its own copy
Folders	Server-side, synchronized	Local only; inbox only on the server
Read/unread and flags	Synchronized across devices	Local to each client
Server storage used	High	Low — mail is typically deleted after download
Offline access	Cached copies	Full, by design
Default port	143	110
Secure port	993 (IMAPS)	995 (POP3S)

Those four port numbers — 143, 993, 110, 995 — are among the most reliably examined facts in the whole email topic. Learn them as two pairs.

Why IMAP Won

POP3 was designed for a world of one computer and expensive server storage. Download the mail, delete it from the server, read it offline over a dial-up connection you were paying for by the minute.

That model breaks the moment someone has a phone, a laptop and a desktop. Mail downloaded to the desktop at work is simply absent from the phone. POP3 clients added a "leave a copy on the server" option, which helps but does not synchronize read status, folders or deletions — so the mailboxes drift apart.

IMAP treats the server as the authoritative store and the clients as views onto it. Storage got cheap, connections got permanent, and the trade-off reversed completely.

What IMAP Actually Does

• Server-side folders. Create, rename and move between folders, and every client sees the same structure.
• Server-side search. Search a mailbox of 50,000 messages without downloading them.
• Partial fetch. Download headers first and the body only when a message is opened — which is why a large attachment does not delay your inbox loading.
• Flags. Read, answered, flagged, deleted, draft — all stored on the server.
• Multiple simultaneous connections to the same mailbox, which is what allows several devices at once.
• IDLE — the push extension. Rather than polling every five minutes, the client holds a connection open and the server notifies it immediately. This is what makes "instant" mail delivery work.

Security

Plain IMAP on port 143 transmits credentials and message content in cleartext. On any untrusted network that is a credential-harvesting opportunity, which is why:

• IMAPS on 993 uses implicit TLS — encrypted from the first byte.
• STARTTLS on 143 upgrades a plaintext connection to TLS. It works, but because it begins in the clear it is vulnerable to a stripping attack where an attacker removes the upgrade offer. Implicit TLS on 993 is the stronger choice.

Two further points worth knowing, both of which show up in incident scenarios:

Legacy protocol authentication bypasses MFA. IMAP and POP3 predate modern authentication and commonly use basic username-and-password auth, which many identity platforms cannot apply conditional access or MFA to. Attackers specifically target legacy endpoints for exactly this reason, and disabling legacy authentication is now standard hardening advice.

IMAP access is a persistence mechanism. An attacker with credentials can read a mailbox continuously via IMAP without ever logging into the webmail interface, which generates very different log entries. Unexpected IMAP connections from unusual locations are a genuine indicator of compromise.

Network+ (N10-009) Exam Tips

• IMAP 143, IMAPS 993, POP3 110, POP3S 995. Memorize all four.
• IMAP synchronizes; POP3 downloads.
• SMTP sends; IMAP and POP3 receive.
• IMAP keeps mail on the server, which is why it suits multiple devices.
• Both use TCP.
• Recognize the troubleshooting symptom: mail visible on one device but not another usually means POP3.

Security+ and CySA+ Angles

Security+ (SY0-701) pairs it with the insecure-versus-secure protocol theme — plaintext IMAP against IMAPS, alongside HTTP/HTTPS, FTP/SFTP and Telnet/SSH — and covers disabling legacy authentication as a hardening control.

CySA+ (CS0-004) is interested in mailbox access as an indicator: IMAP connections from unexpected geographies, legacy authentication used to sidestep MFA, and auto-forwarding rules created after a compromise. Business email compromise investigations lean heavily on these logs.

Key Takeaways

• IMAP retrieves mail while leaving it on the server, keeping devices synchronized.
• POP3 downloads and typically deletes, which breaks multi-device use.
• Ports: IMAP 143, IMAPS 993, POP3 110, POP3S 995.
• SMTP sends; IMAP and POP3 receive.
• Plain IMAP is cleartext — use implicit TLS on 993.
• Legacy IMAP authentication can bypass MFA, which is why attackers target it and why it should be disabled.