Email Ports: A Guide to IMAP, POP3, and SMTP With and Without SSL

The client you've opened is asking you to choose between 993 and 143, or it's throwing a Connection timed out error and you don't know whether the problem is the port or the encryption. This text is a short reference for exactly that moment: the precise number, the corresponding encryption type, and what you actually need to enter in the client fields.

Email ports by server role, not by number

There are three independent roles, and each has its own port. The common mistake is assuming they're all the same thing.

Many people confuse the difference between 465 and 587. Port 465 starts TLS from the very first byte (implicit TLS), but 587 first speaks in plaintext and then upgrades to encryption with the STARTTLS command. If you enter port 587 in the client and set the encryption option to "SSL/TLS", the connection usually drops or you'll see wrong version number in the server log. For 587, you should select "STARTTLS", not SSL.

Which port should I choose: 993 or 143

If your client supports both, choose 993. The reason isn't security, it's simplicity: in implicit TLS mode there's no upgrade step that can fail, and intermediary firewalls tamper with it less. Port 143 with STARTTLS gets stuck more often on corporate networks that have transparent proxies.

But there's one case where 143 is the right choice: when your server only serves unencrypted IMAP on the internal network and the traffic is already inside a tunnel. In any other situation, 143 without STARTTLS means the username and password travel in plaintext over the wire. You can see this in a tcpdump log, and seeing it once is enough to never repeat it.

Where POP3 stands today

POP3 on 995 still works and makes sense for one scenario: a mailbox that just needs to be drained and messages deleted from the server after download. For anything else, go with IMAP. The practical difference is that POP3 doesn't sync the "read" status or folders across devices; if you read a message on your phone, it's still unread on your laptop. If you're forced to work across multiple devices and have chosen POP3, here's where people go wrong: they enable the "leave a copy on server" option, and after a few months the server mailbox fills up and sending email stops, with no clear error in the client. You need to look for the cause in email quota management, not in the port settings.

Common errors and what they actually mean

• Connection timed out on port 25: most cloud providers and home ISPs have blocked outbound port 25. This error is almost never from the client settings.
• SSL routines: wrong version number: the port and encryption mode don't match. The most common case is 587 with direct SSL.
• Certificate verify failed: the hostname in the server field doesn't match the name on the certificate. mail.example.com and smtp.example.com are two different names even if they reach the same server.
• 535 Authentication failed: the port is correct, the problem is the username. In many control panels the username is the full address, not just the part before @.

For a quick test without touching the client, openssl is enough:

openssl s_client -connect mail.example.com:993 -servername mail.example.com
openssl s_client -starttls smtp -connect mail.example.com:587

If the first command prints the certificate, the port and encryption are healthy and the problem is elsewhere. If the second command gets stuck on 250-STARTTLS, your server hasn't advertised STARTTLS and you should try 465.

Set aside port 25 for sending from applications

If you're writing an application that sends transactional email, port 25 is the wrong choice. The reasons are technical: the outbound port is blocked on most networks, there's no mandatory authentication, and delivery rates are low because residential and cloud IPs have little credibility on 25. The right port is 587 with STARTTLS and authentication. For high volume, sending from the host itself also has rate limits; transactional email setup explains why a dedicated sending service is the better choice.

One point that's rarely mentioned: having port 587 open alone doesn't guarantee delivery. If the SPF, DKIM, and DMARC records aren't correct, your message will go to spam even on port 587. Before any other change, check the domain's MX record with the MX record lookup tool to make sure it's actually pointing to the right server.

Recommended settings for a typical client

1. IMAP: server mail.example.com, port 993, encryption SSL/TLS, authentication with normal password.
2. SMTP: same server, port 587, encryption STARTTLS, authentication on.
3. If 587 doesn't work: port 465 with direct SSL/TLS.
4. Enter the hostname exactly as it appears on the certificate.

To migrate a mailbox between two servers, this same port 993 is enough and tools like imapsync work over it. The details are in email migration with IMAP. If you'd rather work without installing a client, the webmail guide is a shorter path.

On a typical shared host, all these ports are already open and ready, and you just need to enter the right number in the client. If you're setting up the server yourself, opening the ports is a small part of the job; a managed Linux host takes this layer off your shoulders and you only deal with the client fields.

Frequently asked questions

Which SMTP port is for sending email, 25 or 587?

For any client or application that authenticates, 587 with STARTTLS is the right choice. Port 25 is designed only for server-to-server relay and its outbound is blocked on most home and cloud networks.

If your provider has blocked 587, 465 with direct SSL is the next alternative. Only use 25 when you have full control over the network and know what you're doing.

What's the difference between IMAP and POP3 in choosing a port?

Both protocols are for receiving email but their working models differ: IMAP keeps messages on the server and syncs status across devices, POP3 downloads them and usually deletes them from the server. The encrypted port for IMAP is 993 and for POP3 is 995.

For working across multiple devices, choose IMAP on 993. POP3 on 995 only makes sense when you're deliberately draining the mailbox.

Why won't port 993 connect but 143 works?

It means something along the network path is blocking direct TLS, usually a corporate firewall or transparent proxy. In this case, 143 with STARTTLS provides similar security and you should select the STARTTLS option in the client, not SSL.

If 143 also connects without STARTTLS, your password is traveling in plaintext over the network. Accept this temporarily and fix the network path at the first opportunity.

Does having port 587 open guarantee email won't go to spam?

No. The port only determines the transport path and plays no role in domain reputation. Inbox delivery depends on SPF, DKIM, and DMARC records, IP reputation, and message content.

If you've fixed the ports and messages still go to spam, go to why emails go to spam. We've written the correct order of investigation there.

The summary that serves you is this one line: receiving on 993, sending on 587 with STARTTLS. If your client gets stuck on 587 with SSL, try 465 and then go to the server log.