IMAP, the Internet Message Access Protocol, is the standard protocol that lets an email client access and manage messages stored on a mail server without moving them off it. In email infrastructure it is the retrieval side of the system: SMTP delivers mail to the mailbox, and IMAP lets users read, search, flag and file that mail from any number of devices at once.
The current version is IMAP4rev2, defined in RFC 9051, which updates the long-lived IMAP4rev1 of RFC 3501. The server is the single source of truth for folders, read status and flags, which is why IMAP displaced POP3 as the default for personal and business mailboxes on the Internet.
How an IMAP session works
An IMAP client opens a long-lived TCP connection to the server and exchanges tagged text commands, each answered with a matching tagged status of OK, NO or BAD. Untagged responses can arrive at any time, which lets the server push mailbox changes while the session stays open.
A session moves through four states: not authenticated, authenticated, selected and logout. Only in the selected state, after a SELECT or EXAMINE command opens a mailbox, can the client fetch, search, flag or move individual messages.
| Command | State required | Purpose |
|---|---|---|
| LOGIN / AUTHENTICATE | Not authenticated | Prove identity, often with SASL or OAuth 2.0 tokens |
| LIST | Authenticated | Enumerate folders and their attributes |
| SELECT / EXAMINE | Authenticated | Open a mailbox read-write or read-only |
| FETCH | Selected | Retrieve headers, flags, body parts or full messages |
| SEARCH | Selected | Find messages by date, sender, flag or text on the server |
| STORE | Selected | Set or clear flags such as \Seen or \Deleted |
| IDLE | Selected | Wait for the server to report new mail in real time |
Message identifiers, flags and synchronization
IMAP identifies messages in two ways. Sequence numbers are positions in the current mailbox and shift when messages are expunged, while UIDs are persistent identifiers that stay valid as long as the mailbox UIDVALIDITY value does not change.
Clients cache messages locally and reconcile them with the server. Extensions such as CONDSTORE and QRESYNC add modification sequence numbers, so a client that reconnects can ask only for what changed since its last session instead of rescanning thousands of flags.
| Flag | Meaning | Typical client behavior |
|---|---|---|
| \Seen | Message has been read | Shown as read on every device |
| \Answered | A reply was sent | Reply arrow icon |
| \Flagged | Marked for attention | Star or flag marker |
| \Deleted | Marked for removal | Hidden or struck through until expunged |
| \Draft | Message is incomplete | Listed in the drafts view |
IMAP compared with POP3 and webmail
The essential difference from POP3 is where the mailbox lives. POP3 is a download protocol that typically moves messages to one device, whereas IMAP keeps them on the server and synchronizes state across all clients.
| Aspect | IMAP | POP3 | Webmail or JMAP |
|---|---|---|---|
| Storage location | Server, cached on clients | Client after download | Server |
| Multi-device sync | Full, including flags and folders | None or minimal | Full |
| Server-side search | Yes | No | Yes |
| Server storage load | High | Low | High |
| Default ports | 143 and 993 | 110 and 995 | 443 |
| Protocol style | Stateful text commands | Simple text commands | HTTP with JSON in JMAP |
IMAP does not send mail. Outgoing messages travel through SMTP submission on port 587 or 465, and the client then appends a copy to the Sent folder over IMAP. Some newer designs, notably JMAP, aim to replace this split with one HTTP-based API.
Securing and operating IMAP servers
Modern deployments should use implicit TLS on port 993, which current guidance prefers over upgrading a plaintext connection on port 143 with STARTTLS. Plaintext IMAP exposes passwords and message content and should be disabled entirely.
Authentication is shifting from passwords to OAuth 2.0 bearer tokens through the SASL XOAUTH2 or OAUTHBEARER mechanisms. Large providers increasingly reject basic authentication, because a stolen IMAP password bypasses multi-factor authentication that protects the web interface.
| Symptom | Likely cause | Remedy |
|---|---|---|
| Client downloads the whole mailbox again | UIDVALIDITY changed after a server migration | Preserve UIDs when migrating |
| Deleted mail reappears | Messages flagged but never expunged | Configure expunge on folder close |
| New mail arrives with delay | Client polls instead of using IDLE | Enable IDLE or push support |
| Login fails after policy change | Basic authentication disabled | Switch to OAuth 2.0 or app passwords |
| Folders missing or duplicated | Different names for special folders | Use SPECIAL-USE attributes |
A practical limitation is the number of concurrent connections. Each open folder that a client watches with IDLE may need its own connection, and servers often cap a user at 10 to 20 sessions, which affects users with many devices.
Understanding it simply
IMAP is the way an email app talks to the place where your mail is kept. Think of a mailbox at the post office that you can open from any location: you read letters there, sort them into folders and mark some as important, but they stay at the post office.
Because the mail never leaves the server, your phone, laptop and tablet all show the same messages in the same state. Read a message on one device, and it appears as read on all the others.
Applied in practice
A small accounting firm with twelve employees moves from POP3 to IMAP after staff complain that messages read on their phones still look unread at their desks. The administrator enables IMAP over TLS on port 993, sets shared folders for client correspondence and turns on OAuth 2.0 sign-in through the firm’s identity provider.
After the change, each employee sees the same folder tree on desktop and mobile, and partners can check a shared client folder without forwarding messages. The firm also gains a central backup point, because every message now resides on the server rather than on scattered laptops, and the old POP3 port is closed.