DevToolsmith

Port 143: IMAP

Port 143 (TCP) is used by IMAP for reading email that stays on the server. It is a well-known port (0–1023). On Linux and macOS, binding to it needs root or the CAP_NET_BIND_SERVICE capability.

Service
IMAP
Protocol
TCP
Range
Well-known (0–1023)
Official
IANA-registered
Exposure
Restrict access
Category
Email

What uses port 143

IMAP keeps mail on the server and syncs folders, read status and flags across devices, which is how phones and desktop clients normally read mail. Port 143 starts unencrypted and can upgrade with STARTTLS; port 993 (IMAPS) is TLS from the first byte and is the safer default.

Should port 143 be open to the internet?

Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.

Check what is listening on port 143

Linux
sudo ss -ltnp 'sport = :143'
macOS
sudo lsof -nP -iTCP:143 -sTCP:LISTEN
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 143 -State Listen
netstat -ano | findstr :143

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 143

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

macOS / Linux
sudo kill $(sudo lsof -t -iTCP:143 -sTCP:LISTEN)
Windows (PowerShell)
Stop-Process -Id (Get-NetTCPConnection -LocalPort 143 -State Listen).OwningProcess

Allow port 143 from trusted networks only

The examples allow 143 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)
sudo ufw allow from 10.0.0.0/8 to any port 143 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 143 proto tcp
RHEL / Fedora / Rocky (firewalld)
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="143" protocol="tcp" accept'
sudo firewall-cmd --reload
Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "IMAP 143/TCP" -Direction Inbound -Protocol TCP -LocalPort 143 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 143 from another machine

macOS / Linux
nc -zv example.com 143
Windows (PowerShell)
Test-NetConnection example.com -Port 143

Related ports

  • Port 993 (IMAPS): used by IMAP over TLS for securely reading email.
  • Port 110 (POP3): used by POP3 for downloading email from a mail server.
  • Port 587 (SMTP submission): the standard port for sending email from apps and mail clients.
  • Port 25 (SMTP): used by SMTP for delivering email between mail servers.

More email ports

465 (SMTPS) , 995 (POP3S) . See all ports in the port lookup.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 143 used for?

Port 143 is used by IMAP for reading email that stays on the server. IMAP keeps mail on the server and syncs folders, read status and flags across devices, which is how phones and desktop clients normally read mail. Port 143 starts unencrypted and can upgrade with STARTTLS; port 993 (IMAPS) is TLS from the first byte and is the safer default.

Is it safe to open port 143?

Only open this port to known networks or users, for example your office IP, a VPN or behind authentication. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 143 is open?

On the server, list listening sockets with "sudo ss -ltnp 'sport = :143'" on Linux or "sudo lsof -nP -i :143" on macOS. From another machine, run "nc -zv host 143" or, on Windows, "Test-NetConnection host -Port 143". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.