{
  "port": 143,
  "protocol": "tcp",
  "service": "IMAP",
  "oneLiner": "IMAP — server-side mailboxes with folders, flags, and search, kept in sync across devices.",
  "whatItIs": "Clients issue tagged commands (CAPABILITY, LOGIN, SELECT, FETCH, SEARCH) and the server keeps the authoritative state, so messages, flags, and folders look the same on every device. Port 143 is the cleartext port; the STARTTLS upgrade happens here, while implicit TLS runs on 993, which is what most clients now use. Dovecot and Cyrus are the common self-hosted servers, and 143 is often left open for LAN clients and migration tools. IMAP is retrieval only — sending still goes out over submission on 587.",
  "exposure": {
    "verdict": "careful",
    "note": "Expose only with STARTTLS required before LOGIN; plain 143 sends mailbox credentials in the clear, so prefer 993."
  },
  "checkCommand": "printf 'a1 CAPABILITY\\r\\na2 LOGOUT\\r\\n' | nc -v MAIL_HOST 143",
  "links": [
    {
      "title": "RFC 9051 — Internet Message Access Protocol (IMAP) Version 4rev2",
      "url": "https://www.rfc-editor.org/rfc/rfc9051.html",
      "kind": "spec"
    },
    {
      "title": "Dovecot (IMAP/POP3 server) source repository",
      "url": "https://github.com/dovecot/core",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}