Port reference
Port 143 (TCP) – IMAP
Mailbox-access protocol that keeps mail on the server and syncs folders to clients, cleartext by default.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on mail servers offering IMAP access; often exposed to the internet alongside IMAPS on 993.
What is port 143 used for?
Port 143 is the default port for IMAP (Internet Message Access Protocol), which keeps your mail on the server and syncs folders and read/unread state across all your devices. That's why the same inbox looks identical on your phone and laptop. Clients like Outlook, Thunderbird, and Apple Mail use it, and servers like Dovecot offer it. Unlike POP3 it's built for multi-device access; the encrypted version is IMAPS on port 993.
When would you open it?
You'd open or forward port 143 only if you run a mail server and need clients to reach their mailboxes over plain IMAP. Most modern setups use the encrypted IMAPS on 993 instead, keeping 143 only for legacy clients or internal STARTTLS connections.
Is it safe to open?
Plain IMAP sends your password and mail in cleartext, exposing them to anyone on the network, so use IMAPS on 993 or enforce STARTTLS to encrypt the session. See the security notes below.
How to check if this port is open
ss -tulpn | grep :143
nmap -p 143 <target>netstat -ano | findstr :143
Test-NetConnection <host> -Port 143lsof -i :143
nmap -p 143 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 143 to your device's local IP, internal port 143, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 143/tcpsudo firewall-cmd --permanent --add-port=143/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 143 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 143" -Direction Inbound -Protocol TCP -LocalPort 143 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Cleartext credential and message capture via sniffing
- Credential brute force and password spraying
- STARTTLS stripping / downgrade to cleartext
- Credential stuffing and reuse against other services
Hardening
- Use IMAPS on port 993 (implicit TLS), or enforce STARTTLS on 143
- Disable plaintext logins; require TLS before authentication
- Add rate limiting / lockout and enforce strong passwords or MFA
- Restrict access by source IP or VPN where possible
How to block this port
sudo ufw deny 143/tcpsudo firewall-cmd --permanent --remove-port=143/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 143 -j DROPNew-NetFirewallRule -DisplayName "Block 143" -Direction Inbound -Protocol TCP -LocalPort 143 -Action Blocknmap snippet
nmap -p143 --script imap-capabilities,imap-ntlm-info,banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is IMAP on port 143 secure?
- Not by default. Plain IMAP on port 143 sends the username, password, and messages in cleartext. Use IMAPS on port 993 or enforce STARTTLS so the session is encrypted.
- What is the difference between port 143 and 993?
- Port 143 is plain IMAP (cleartext unless STARTTLS is negotiated). Port 993 is IMAPS, which wraps the entire session in TLS from the start, encrypting credentials and mail.