IMAP
Internet Message Access ProtocolIMAP is how you read mail that never leaves the server. Rather than downloading a message and owning it, a client browses folders and fetches only the parts it needs, and every flag and folder change is stored centrally — so phone, laptop and webmail all show the same mailbox.
IMAP keeps the mailbox on the server and synchronises state — which is why reading a message on your phone marks it read everywhere.
How it works
Because the server holds the truth, clients are caches rather than owners. IDLE keeps the connection open so the server can push news of a new message instead of being polled.
What IMAP does, step by step
The client opens a TLS connection to 993 and logs in — or upgrades port 143 with STARTTLS.
SELECT or EXAMINE opens a folder and reports its message count, unseen count and validity.
Envelopes and flags to draw the list; a single MIME part when the user actually opens something.
Flags, moves and deletions are STORE and COPY commands — every client sees the same result.
In cybersecurity
IMAP is a standing door to everything a person has ever written — and because clients stay logged in for months, a stolen credential is rarely noticed quickly.
Port 993 from the start; plain 143 without STARTTLS puts the password on the wire.
Basic IMAP login predates it — disable it, or one password is the whole account.
Long-lived per-client secrets are rarely rotated and often stored in plain text.
An intruder’s forwarding or auto-delete rule quietly exfiltrates mail for months.
Unlike POP3, a compromise reaches the entire archive, not just what is undownloaded.
Modern clients use a token that can be scoped and revoked without changing the password.