Email protocols series. This is the tactical IMAP configuration guide. For the conceptual overview of how SMTP, IMAP and POP3 fit together, read the email protocols hub →
Quick IMAP configuration reference
IMAP (Internet Message Access Protocol) keeps mail on the server and synchronizes state across every client that connects. Read a message on your phone, it shows as read on your laptop. Move it to a folder, the folder change appears everywhere. This is what modern mail expects; POP3, which downloads-and-deletes, is the alternative used in narrow archival cases.
| Modern default | Port 993 + Implicit TLS + AUTH (LOGIN or OAuth2) |
| Legacy alternative | Port 143 + STARTTLS + AUTH |
| Never use | Port 143 without TLS (credentials in plaintext) |
| 2FA accounts | App password or OAuth2, never your main account password |
| RFC reference | RFC 9051 (IMAP4rev2, 2021), RFC 3501 (IMAP4rev1, still widely deployed) |
This guide focuses on the actual configuration: hostname, port, username, password, TLS mode, plus the special-case settings for folder mapping that trip up Outlook and Apple Mail. For context on what IMAP is and how it compares to POP3 and SMTP at the protocol level, see our email protocols overview.
Before you start: 4 things to confirm
- IMAP is enabled on the account. Many providers ship with IMAP off by default. Gmail requires you to enable it in Settings → Forwarding and POP/IMAP. Microsoft 365 admins control it per-mailbox. Yahoo enables it by default but enforces app passwords. Confirm in the web UI before troubleshooting client errors.
- You have the right credentials. For 2FA-enabled accounts, your regular password is rejected. Generate an app password or set up OAuth2 first.
- The port is reachable. 993 and 143 are rarely blocked but corporate firewalls sometimes block them. Test with
telnet imap.example.com 993before fighting the client. - Your client supports TLS 1.2+. Old clients fail silently on the TLS handshake. Update or replace.
The 4 things every IMAP setup needs
| Setting | What it is | Common values |
|---|---|---|
| Server hostname | The IMAP endpoint of your mail provider | imap.gmail.com, outlook.office365.com, imap.mail.yahoo.com, imap.mail.me.com |
| Port | The TCP port | 993 (Implicit TLS, modern default), 143 (STARTTLS, legacy) |
| Authentication | How you prove identity | Username + password (LOGIN), app password, OAuth2 |
| Encryption | How the connection is secured | SSL/Implicit TLS (on 993), STARTTLS (on 143) |
Port selection: 993 vs 143
Port 993 (modern default)
Implicit TLS from the first byte. Authentication required. This is what every modern client uses. All major providers expose IMAP on 993.
Port 143 (legacy with STARTTLS)
Plaintext start, upgrade to TLS via STARTTLS command. Still supported by most providers but offers no real advantage over 993, and the STARTTLS step adds a small failure mode (older clients sometimes skip the upgrade). Use only if 993 is firewalled.
Decision rule: use 993 by default. Fall back to 143 with STARTTLS only when 993 is blocked.
Authentication mechanisms
Same picture as SMTP, with one IMAP-specific twist:
- LOGIN. Username + password over the TLS-encrypted connection. Universal default. The user must be the full email address at most providers.
- App passwords. Required when 2FA is enabled (Gmail, Microsoft 365, Yahoo, iCloud, FastMail). Generate in account security settings; one per client.
- OAuth2. Modern token-based auth. Gmail (XOAUTH2), Microsoft 365 (OAuth2/Modern Auth), and Yahoo support it for IMAP. Apple has limited OAuth2 for IMAP. Prefer where available.
- PLAIN, CRAM-MD5, DIGEST-MD5. Older mechanisms still negotiable but obsolete; the client and server usually agree on LOGIN or OAuth2 without you touching them.
TLS configuration
| Client label | What it means | Port |
|---|---|---|
| SSL/TLS or “Implicit TLS” | TLS from the first byte | 993 |
| STARTTLS or “TLS” | Plaintext start, upgrade to TLS | 143 |
| None | Plaintext throughout (never use) | n/a |
The labels in client UIs are again inconsistent. Match the port: 993 = SSL/Implicit TLS; 143 = STARTTLS. If the client lets you set them independently, make sure both values align.
IMAP folder mapping
This is where IMAP setup goes from “should just work” to “why are my sent messages in two folders”. IMAP doesn’t standardize folder names: providers call sent messages “Sent” or “Sent Items” or “[Gmail]/Sent Mail” depending on heritage, and clients have to learn which folder is which.
Three approaches:
- Auto-detection (SPECIAL-USE extension, RFC 6154). Modern IMAP servers advertise which folder is Sent, Drafts, Trash, Junk, Archive. Modern clients read those advertisements and map automatically. This is what you want; almost always works for new setups against Gmail, Microsoft 365, FastMail, iCloud.
- Manual mapping. If auto-detection fails (older client, non-standard server), the client lets you pick which folder is Sent / Drafts / Trash. Look in the account’s advanced settings.
- IMAP subscriptions. Some servers expose more folders than the client should subscribe to. Use the “Subscribe to folders” or “Manage subscriptions” feature to hide the noise (calendar shadows, archive history, internal admin folders).
Symptoms of bad folder mapping: sent messages appear in Inbox; deleting moves to “Trash” but the server still keeps them in “Bin”; drafts duplicate on every save. Each of these traces back to a folder the client thinks means one thing and the server uses for another.
Setup walkthrough by client type
Desktop clients (Thunderbird, Apple Mail, Outlook desktop)
Add account → manual configuration → incoming server. Set IMAP server hostname, port 993, SSL/Implicit TLS, username (full email), password (app password if 2FA on). Save, let the client download folder list. Verify Sent, Drafts, Trash map correctly by sending a test from a different device and watching it appear in Sent.
WordPress (rare but happens)
WordPress doesn’t read IMAP by default. Plugins like Post by Email or contact form integrations may poll an IMAP mailbox. Configuration is provider hostname, 993, SSL, username, password. The plugin polls on a schedule (often hourly via wp-cron); slow polling is normal.
Mobile (iOS Mail, Gmail Android)
iOS: Settings → Mail → Accounts → Add → Other → Add Mail Account → IMAP. Enter incoming (IMAP, 993, SSL on) and outgoing (SMTP, 587, STARTTLS) servers separately. Gmail Android: choose “Personal (IMAP)” for custom domains; auto-config for major providers.
Programmatic (Python imaplib, Node node-imap)
Python imaplib example:
import imaplib
mail = imaplib.IMAP4_SSL('imap.example.com', 993)
mail.login('user@example.com', 'app-password')
mail.select('INBOX')
typ, data = mail.search(None, 'UNSEEN')Node node-imap:
const Imap = require('node-imap');
const imap = new Imap({
user: 'user@example.com',
password: 'app-password',
host: 'imap.example.com',
port: 993,
tls: true
});Provider-specific quick links
- Gmail IMAP settings (imap.gmail.com, 993, app password or OAuth2)
- Outlook / Microsoft 365 IMAP settings (outlook.office365.com or imap-mail.outlook.com, 993)
- Yahoo Mail IMAP settings (imap.mail.yahoo.com, 993, app password required)
- iCloud IMAP settings (imap.mail.me.com, 993, app password required)
- FastMail (imap.fastmail.com, 993), ProtonMail (via Bridge), and other privacy providers expose IMAP with their own auth flows
Testing your IMAP setup
OpenSSL connection test
openssl s_client -connect imap.example.com:993 -crlfShows the TLS handshake and the server’s IMAP greeting (* OK). Then issue:
a1 LOGIN user@example.com app-password
a2 LIST "" "*"
a3 LOGOUTThe LIST command returns every folder; if you see your Inbox, Sent, Drafts, Trash, the server side is healthy.
imaplib quick check
A 4-line Python script (above) tells you in seconds whether credentials and TLS work. If it succeeds and your desktop client fails, the problem is in the client, not the server.
Diagnosing common IMAP errors
| Error | Likely cause | Fix |
|---|---|---|
NO Authentication failed | Wrong password, or 2FA + main password used | Generate app password or use OAuth2 |
NO IMAP access is disabled | Provider has IMAP off for this mailbox | Enable in web UI (Gmail Settings → IMAP, Microsoft admin) |
| “Account is offline” / “Cannot connect” | Network, firewall, or wrong hostname | Test with openssl or telnet on 993 |
| Sent messages appear in Inbox | Folder mapping wrong; client doesn’t know which folder is Sent | Set Sent folder manually in account advanced settings |
| Drafts duplicate on every save | Client and server disagree on Drafts folder | Map Drafts manually; consider clearing local cache |
| “Too many simultaneous connections” | Provider connection limit (Gmail = 15, Yahoo = 10) | Reduce concurrent IMAP clients per account |
| Slow folder listing | Huge folders (10K+ messages) and full sync on every check | Enable IDLE-based push if supported; archive old messages |
| “Certificate untrusted” | Self-signed or expired cert; rare with major providers | Verify with openssl; update CA bundle on the client |
10 common IMAP setup mistakes
- Forgetting to enable IMAP in the web UI. Most common Gmail and Microsoft 365 setup failure.
- Using account password with 2FA enabled. Need an app password or OAuth2.
- Pairing port 993 with STARTTLS, or 143 with Implicit TLS. Combinations must match.
- Skipping folder mapping verification. Send a test from a different device, watch it appear in the right Sent folder.
- Too many simultaneous clients. Gmail caps at 15 IMAP connections per account. Web client + desktop + phone + tablet + integrations adds up.
- Polling instead of IDLE. Modern clients support IMAP IDLE for server-push notifications. Polling every 60 seconds works but is wasteful and slow.
- Not using TLS on port 143. Always use STARTTLS on 143. Plaintext IMAP leaks credentials.
- Hardcoded hostnames for shifting infrastructure. Microsoft 365 uses
outlook.office365.comfor business andimap-mail.outlook.comfor consumer; pick by account type. - Subscribing to too many folders. 100+ folders bog down the sync. Subscribe only to what you actually use.
- Treating IMAP as a backup mechanism. IMAP is sync, not backup. Deletions sync too. Use a dedicated backup tool (or POP3 with “leave on server” disabled for archival).
IMAP configuration FAQ
Should I use IMAP or POP3?
IMAP for almost every case. It keeps mail on the server, syncs state across devices, and supports modern features like server-side search and push notifications. POP3 downloads-and-deletes by default (or downloads-and-leaves-on-server, but without syncing read/unread state). Use POP3 only for narrow archival use cases or when bandwidth is severely constrained. See our POP3 configuration guide for the cases where POP3 still makes sense.
Why are my Sent messages appearing in the Inbox?
Folder mapping mismatch. Your client thinks the Sent folder is something different from what the server uses. Go to the account’s advanced settings and manually map the Sent folder to the server’s actual name (often “[Gmail]/Sent Mail” for Gmail, “Sent Items” for Microsoft, “Sent” for FastMail). For new setups, this usually resolves auto-detection issues from older client versions.
How many simultaneous IMAP connections can I have?
Provider-dependent. Gmail allows 15 IMAP connections per account; Yahoo 10; Microsoft 365 limits vary by license. Each device with the account configured uses 1 to 3 connections (one per opened folder + idle). A user with web + desktop + phone + tablet + smartwatch and a third-party app integration can easily hit the limit. Symptom is “too many simultaneous connections” errors; fix is to reduce or stagger access.
Does IMAP support push notifications?
Yes, via the IMAP IDLE command (RFC 2177). When the client issues IDLE, the server holds the connection open and notifies the client of new messages immediately. Most modern clients use IDLE by default for the Inbox; some only poll the Inbox and check other folders on a schedule. Mobile mail apps often translate IDLE notifications into native push.
Can I use IMAP for very large mailboxes?
Yes, but performance degrades when a single folder holds tens of thousands of messages. The first full sync takes longer, search across all mail is slower, and clients sometimes cache aggressively, eating disk space. For very large archives, use server-side search via the web UI, keep recent messages in the active folder, and move old mail to an archive folder that the client doesn’t constantly resync.
What is IMAP4rev2?
The 2021 revision of IMAP, defined in RFC 9051. It folds in 25 years of extensions (UTF-8 support, lessons from large-scale deployment) and updates security defaults. Most major servers still advertise IMAP4rev1 (RFC 3501) for client compatibility while supporting many IMAP4rev2 features under the same protocol negotiation. For end-user setup, the distinction rarely matters; the client just talks IMAP and the server handles the version.
Final words
IMAP setup is straightforward when the prerequisites are right: enabled on the account, app password or OAuth2 in hand, port 993 reachable. Where it gets tedious is folder mapping: the protocol left folder names as a per-provider convention, and 30 years of email evolution mean every provider’s folder layout is slightly different. Spend the five extra minutes after setup to verify Sent, Drafts, Trash all map correctly; you save hours of “why is my email weird” later.
For broader context, see the email protocols overview, the companion SMTP setup guide, the POP3 configuration guide, and our SSL/TLS for email guide.
Clean your list before IMAP fetches a single message.
SMTPing catches what regex misses: disposable addresses, role-based emails, catch-all domains, syntax errors, dead mailboxes and known traps. 13 validation types, 25 free checks daily, no card required.
About the Author
Alaa · LinkedIn
Email infrastructure specialist with 8+ years of hands-on experience in SMTP, deliverability, and email verification. I’ve configured and troubleshot mail systems across Postfix, Exchange, and cloud relays, managed IP reputation and warmup campaigns, and built verification pipelines processing millions of addresses. My work spans DNS authentication (SPF, DKIM, DMARC, BIMI), bounce handling, blocklist monitoring, and compliance frameworks including CAN-SPAM and GDPR. I write every article on SMTPedia to give email professionals, developers, and marketers the accurate, RFC-grounded reference they need.
About SMTPedia
SMTPedia is an independent email industry reference covering SMTP, IMAP, POP3, email deliverability, marketing platforms, DNS authentication, and email verification. Every article is researched from official provider documentation, IETF RFCs, and industry best practices. Settings and configurations are verified quarterly.
We are cited as a source by ChatGPT, Microsoft Copilot, and thousands of email professionals worldwide. Learn more about our editorial process.
