Port 143 IMAP · TCP

What runs on port 143

IMAP: mailbox access that keeps mail on the server, with folders, flags and server-side search. Port 143 is plaintext with STARTTLS; 993 is IMAP over implicit TLS. Either is fine if TLS is enforced; a server that accepts a login on 143 before STARTTLS is the problem.

Software that uses it: Dovecot · Cyrus IMAP · Courier · Exchange · Gmail/Fastmail (as clients see them)

Should port 143 be open?

Internet-facing only with authentication and care. It can be exposed when the service behind it is authenticated, rate-limited and kept up to date; most deployments are better off behind a VPN, an allow-list or a reverse proxy.

• Dovecot: ssl = required refuses plaintext logins on 143.
• IMAP IDLE keeps a connection open for push; proxies and NAT with short timeouts break it.

Check port 143

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :143'
sudo lsof -i :143

# from another machine: is it reachable?
nc -zv host 143
nmap -p 143 host
curl -v telnet://host:143      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 143

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 143 proto tcp
sudo ufw deny 143/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 143 accept
nft add rule inet filter input tcp dport 143 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 143 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 143 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=143 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 143" with no source is just "open".

Related ports

• 993 IMAPS — IMAP over TLS
• 110 POP3 — Mail retrieval, plaintext
• 995 POP3S — POP3 over TLS
• 587 SMTP submission — Mail from clients, STARTTLS

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions