Port 993 IMAPS · TCP

What runs on port 993

IMAPS: IMAP over implicit TLS, the port every mail app uses by default. Where 143 needs the client to request STARTTLS, 993 is encrypted from the first byte and cannot be downgraded. The usual public-facing port for a mail server alongside 465/587 for submission.

Software that uses it: Dovecot · Cyrus · Courier · Exchange · Gmail, Fastmail, iCloud, Outlook.com (as servers)

Should port 993 be open?

Designed to face the internet. This port exists to be reachable from anywhere, so the usual question is not whether to open it but how the service behind it is configured and patched.

• Brute force on 993 is constant; fail2ban's dovecot jail and strong passwords or app passwords are the defence.
• openssl s_client -connect mail:993 then "a1 CAPABILITY" shows what the server supports.

Check port 993

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :993'
sudo lsof -i :993

# from another machine: is it reachable?
nc -zv host 993
nmap -p 993 host
curl -v telnet://host:993      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 993

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 993 proto tcp
sudo ufw deny 993/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 993 accept
nft add rule inet filter input tcp dport 993 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 993 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 993 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=993 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 993" with no source is just "open".

Related ports

• 143 IMAP — Mail access, plaintext/STARTTLS
• 995 POP3S — POP3 over TLS
• 465 SMTPS — Mail submission over implicit TLS
• 587 SMTP submission — Mail from clients, STARTTLS

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions