Two ports, two ways of encrypting and one very common mistake — pairing them wrongly and getting a dropped connection with no clear explanation. Here is what 993 and 143 stand for, when each is needed, and how to read the server’s answer when a connection fails.
What 993 and 143 mean
Port 993 is IMAPS: encryption starts immediately, before the client says a single word to the server. This mode is called implicit TLS, or simply SSL/TLS.
Port 143 is plain IMAP, where the session opens unencrypted and upgrades with the STARTTLS command. On its own 143 does not mean "no encryption", but it does mean the first bytes travel in the clear.
The practical choice: if the server offers 993, take 993. STARTTLS on 143 is for servers where 993 is not open — which happens on corporate mail servers and at some hosting providers.
993 + SSL/TLS — the default, works almost everywhere.
143 + STARTTLS — when 993 is closed.
143 with no encryption — not supported: the password would cross the network in plain text.
Why we never connect unencrypted
IMAP without TLS sends the login and the password as plain text. Every hop along the way — from café Wi-Fi to a transit provider — sees them in full. That is why there is no "no encryption" option in the form at all: a deliberate limit, not an unfinished feature.
For the same reason there is no "skip certificate check" switch. The certificate is verified against the name you typed into the server field: if the server presents a different name, the connection stops and the reason goes into the log.
How to read connection errors
The server’s answer almost always points at the exact problem — if you know what to look for.
The connection closes right after the greeting — usually STARTTLS selected on port 993, or SSL/TLS on 143. The port and the mode have to match.
A timeout with no answer — the port is blocked by a firewall or the provider, or the IMAP service is not running (common on Exchange).
A certificate verification error — the name in the certificate does not match what you typed. The log shows the expected name, and that is usually the correct server address.
AUTHENTICATIONFAILED with a correct password — unrelated to ports: either an app password is required, or the login has no domain, or IMAP is disabled in the mailbox settings.
Which one if the provider offers both 993 and 143?
Take 993 with SSL/TLS. There is no speed difference, and encryption starts immediately with no plaintext stage in between.
Can I use a non-standard port?
Yes — the advanced connection settings accept a manual port. The encryption requirement still applies.
Our server only supports 143. Is that safe?
Yes, when STARTTLS is available: the session upgrades to encryption before the password is sent. Without STARTTLS we will not connect at all.
Why does the connection drop immediately?
Most often the port and the encryption mode disagree: 993 expects TLS from the first byte, 143 expects a STARTTLS command. Switch the mode and check again.
Find out how big your mailbox is. It costs nothing.
Connect two servers, look at the size and decide. Or take the client and keep everything on your side.