Port reference
Port 993 (TCP) – IMAPS
IMAPS — IMAP mailbox access encrypted with implicit TLS from connect.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Encrypted
- Risk level
- Low
Lower risk, but still expose it only when you actually need it.
Default state
Open on mail servers offering secure IMAP. Usually exposed to the internet so clients can read mail over TLS.
What is port 993 used for?
Port 993 is IMAPS, IMAP encrypted with TLS from the moment you connect. It is how mail apps read and sync your mailbox from the server, so messages stay in place and appear on every device. Clients like Outlook, Thunderbird, Apple Mail, and the Gmail app use it to connect to servers such as Dovecot and Courier. It is the secure equivalent of plain IMAP on port 143.
When would you open it?
You open port 993 if you run your own mail server and want mail clients to fetch messages over encrypted IMAP. A typical case is a Dovecot installation that users access remotely from their phones and laptops. If you only use a hosted email provider, you never open this port yourself; you just enter it in your mail client.
Is it safe to open?
The encrypted channel is sound, but accounts can still be brute-forced, so enforce strong passwords, MFA, and modern TLS, and keep the server patched. See the security notes below.
How to check if this port is open
ss -tulpn | grep :993
nmap -p 993 <target>netstat -ano | findstr :993
Test-NetConnection <host> -Port 993lsof -i :993
nmap -p 993 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 993 to your device's local IP, internal port 993, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 993/tcpsudo firewall-cmd --permanent --add-port=993/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 993 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 993" -Direction Inbound -Protocol TCP -LocalPort 993 -Action AllowSecurity & risks
Common attacks
- Credential brute force and password spraying against IMAP login
- Weak/deprecated TLS exploitation and downgrade
- Account takeover via leaked/reused credentials
- Legacy/basic-auth abuse bypassing MFA
Hardening
- Require TLS 1.2/1.3 and disable weak ciphers and old protocols
- Use strong, unique passwords and enforce MFA / OAuth where possible
- Rate-limit logins and lock out brute force; alert on impossible travel
- Disable legacy/basic auth that bypasses MFA
- Keep the IMAP server patched and use valid certificates
How to block this port
sudo ufw deny 993/tcpsudo firewall-cmd --permanent --remove-port=993/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 993 -j DROPNew-NetFirewallRule -DisplayName "Block 993" -Direction Inbound -Protocol TCP -LocalPort 993 -Action Blocknmap snippet
nmap -p993 --script imap-capabilities,ssl-enum-ciphers,ssl-cert <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 993 and 143?
- Port 143 is plain IMAP (optionally upgraded with STARTTLS); port 993 is IMAPS, encrypted with implicit TLS from connect. Use 993 to guarantee the session is always encrypted.
- Is port 993 secure?
- The TLS transport is secure when configured well, but the account itself can still be brute-forced or phished. Enforce strong TLS plus strong passwords and MFA.