220

Port 220/tcp is registered with IANA as imap3 with the description "Interactive Mail Access Protocol v3," assignee James Rice, and a blank reference field (dual-registered on TCP and UDP). IMAP version 3 is defined in RFC 1203 (J. Rice, Stanford, February 1991), which obsoleted RFC 1064 (IMAP2) and was written as a counter-proposal to RFC 1176; the spec states that when TCP is used the IMAP server listens on port 220. IMAP3 added solicited and unsolicited data tagging, client-managed user flags, and explicit read-only-mailbox handling. The IANA reference field is blank. The single most important point about this port is a disambiguation: 220/imap3 is the obsolete IMAP version 3 and is not modern IMAP. IMAP3 was never accepted by the marketplace, the IESG reclassified RFC 1203 as Historic in 1993, and the IMAP Working Group built IMAP4 and IMAP4rev1 from RFC 1176's lineage instead — so the modern protocol (IMAP4rev1/rev2, RFC 3501 / RFC 9051) runs on port 143 (imap) and port 993 (imaps, over TLS), both covered in earlier batches. Security-wise the chief practical issue is misidentification or confusion with modern IMAP; the protocol is plaintext with no TLS, and essentially no real servers listen here. For an analyst, an open 220 is a relic or a mislabel and should not be treated as a modern mailbox service — check 143 and 993 for that.

IANA assignment

imap3 — "Interactive Mail Access Protocol v3"; reference (blank — no RFC cited in IANA registry); assignee James Rice; dual-registered 220/tcp + 220/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

essentially absent from modern servers (de-facto) [Well-established] — nmap-services file

Related ports

143 (imap), 993 (imaps), 109/110 (POP2/POP3)

Primary use

IMAP version 3 mailbox access (RFC 1203); obsolete (Historic since 1993)

Other/unofficial uses

none today [Well-established]

Security implications

obsolete; plaintext, no TLS; chief issue is confusion with modern IMAP (143/993) [Well-established]

Typically seen on

relic/old hosts; otherwise mislabeled services

Analyst note

An open 220 is a relic or a mislabel — do NOT treat it as a modern mailbox service; check 143/993 for modern IMAP.

Port 220/udp is registered with IANA as imap3, described as "Interactive Mail Access Protocol v3," with assignee and contact both listed as James Rice. The registration date, modification date, and reference (RFC) columns are all blank in the live IANA Service Name and Port Number Registry, so those fields are reported as unknown rather than guessed. The same service name, description, assignee, and contact are dual-registered on 220/tcp with identical blank date/reference fields — a routine TCP/UDP symmetric registration, not evidence of independent UDP-specific use. IMAP3 itself is a piece of IETF history rather than a live protocol: it was specified in RFC 1203 (1991) as a rival proposal to RFC 1176's IMAP2, was never meaningfully adopted, and the IESG reclassified RFC 1203 as Historic in 1993 once the working group built IMAP4 — today's standard, served on ports 143/tcp and 993/tcp — from the IMAP2 lineage instead. No actively maintained mail server or client documents real support for IMAP3 on port 220 in either transport, and no UDP-specific IMAP3 use case was found; the UDP registration reads as a registry-symmetry artifact rather than a deployed service. Because the protocol is effectively dead, a host answering on 220/udp is more plausibly scanner noise, a generic UDP responder, or a honeypot/decoy than genuine IMAP3 traffic, and no CVEs or vendor advisories specific to "IMAP3 on port 220" were located.

IANA assignment

imap3 — "Interactive Mail Access Protocol v3"; reference (blank — no RFC cited in IANA registry); assignee/contact [James_Rice]; dual-registered 220/tcp + 220/udp with identical blank date/reference fields

[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (udp), :542 (tcp)

Range class

well-known (0–1023)

Prevalence

nmap-services observed open-frequency 220/udp ≈ 0.000445 (very low — roughly 4 in 10,000 scanned hosts in the nmap-services sample); the dual-registered 220/tcp side is rarer at ≈ 0.000113 [Confirmed] — nmap-services dataset

Related ports

143/tcp and 993/tcp (IMAP4, the protocol that superseded IMAP3) [Confirmed] — https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol

Primary use

historic IMAP3 mail-access protocol per RFC 1203 (1991); never widely adopted, reclassified Historic by the IESG in 1993 in favor of IMAP4 (143/993)

Security implications

because IMAP3 is effectively unused, a responsive 220/udp host is more likely scanner noise, a generic UDP echo-style responder, or a decoy/honeypot than genuine IMAP3 traffic; no CVEs or vendor advisories specific to "IMAP3 on port 220" were found

Typically seen on

not established this cycle beyond the historic-protocol/scanner-noise framing above [Unknown]

UDP-specific use

no evidence of an active or historical UDP-specific IMAP3 deployment found; the 220/udp registration is symmetric with 220/tcp rather than reflecting distinct transport-level use [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=220

Current software support

no actively maintained mail server or client implementing IMAP3 on port 220 (tcp or udp) was found [Unknown] — no source

Scanning activity (point-in-time)

SANS ISC's port-220 activity page showed ongoing low-volume scanning against 220 (tcp/udp) with an overall "green" (no elevated concern) threat indicator as of the 2026-07-16 check; figures are day-to-day variable, not a stable historical fact

[Confirmed, snapshot] — https://isc.sans.edu/data/port/220