993

Port 993/tcp is IMAP over implicit TLS — the modern default for mailbox access, where the TLS handshake completes before any IMAP data is exchanged. The IMAP semantics are identical to port 143 (stateful mailbox sync with SELECT/FETCH/SEARCH/STORE/IDLE), but encrypting from the first byte eliminates the cleartext negotiation window and the STARTTLS-stripping/command-injection risk that affects 143. RFC 8314 prefers this implicit-TLS model over cleartext-plus-STARTTLS for client mail access, noting that implicit TLS is in practice more widely deployed for IMAP/POP than STARTTLS; the IANA registry was updated accordingly and now references RFC 3501, RFC 8314, and RFC 9051 for the imaps entry. Encryption protects the session in transit, but 993 is still a heavy target for credential brute-force and credential-stuffing/password-spray, and legacy IMAP basic authentication historically bypassed MFA — a documented avenue for account takeover. Proofpoint's 2018–2019 research on IMAP-based password spraying reported that a large share of Microsoft 365 and Google Workspace tenants were targeted, with a meaningful fraction experiencing at least one compromised account; app-passwords and OAuth (XOAUTH2), which 993 supports, are the current mitigations, and providers are retiring legacy basic auth. For an analyst, an open 993/tcp indicates a secure IMAP mailbox server; validate the certificate, require TLS ≥1.2, and determine whether legacy basic auth is disabled in favor of OAuth.

IANA assignment

imaps — "IMAP over TLS protocol"; reference [RFC3501][RFC8314][RFC9051]; assignee IESG/IETF Chair; modified 2021-02-22. (993/udp is Reserved, [RFC9051]) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency 0.027199 [Well-established] — nmap-services file

Related ports

143 (IMAP cleartext/STARTTLS); parallels 995 and 465; SRV label _imaps._tcp (RFC 6186)

Primary use

IMAP mailbox access over implicit TLS; modern default for secure mail retrieval/sync

Other/unofficial uses

none notable beyond IMAPS itself [n/a]

Security implications

eliminates STARTTLS-stripping risk; still subject to credential brute-force and credential-stuffing/password-spray; legacy basic auth bypassed MFA. App-passwords/OAuth (XOAUTH2) are the mitigations

Typically seen on

IMAP mailbox servers and cloud mail platforms (Gmail, Outlook.com/Microsoft 365, Yahoo, iCloud)

Analyst note

Open 993/tcp indicates a secure IMAP mailbox server. Validate the certificate, require TLS 1.2+, and confirm whether legacy basic auth is disabled in favor of OAuth.

Port 993/udp is registered with IANA as Reserved, carrying the reference [RFC9051] and a modification date of 2021-02-22. It is the UDP sibling of the far better-known 993/tcp, which is imaps — IMAP over Implicit TLS (assignee [IESG], contact [IETF_Chair], references [RFC3501][RFC8314][RFC9051]). The distinction matters: every piece of real-world software that speaks IMAPS — Dovecot, Courier IMAP, Thunderbird, Apple Mail, Microsoft Outlook — connects over TCP/993 only, because IMAP is a TCP-oriented protocol and RFC 9051 (IMAP4rev2, 2021) defines no UDP transport. The UDP slot at 993 was historically unused, and the IANA port-registry update that accompanied RFC 9051's publication formalised it as Reserved. Notably, the RFC 9051 text itself specifies TCP exclusively and does not discuss UDP at all; the Reserved designation is an artifact of the registry process, not an explicit instruction in the RFC body — so the [RFC9051] reference is best read as the registry's pointer, not as a UDP specification. For an analyst, the practical takeaway is that no legitimate service runs on 993/udp. Internet-wide UDP scanners (Shodan, Masscan) probe reserved ports anyway, so any host that actually answers on 993/udp is anomalous and worth investigating. Published threat reporting on "port 993" — including Tofsee's IMAP-based C2 — concerns TCP/993 (IMAPS), not UDP; there is no documented malware family or abuse campaign that uses 993/udp as a distinct UDP port.

IANA assignment

Reserved; service-name field blank for the UDP row; reference [RFC9051]; assignee blank; modified 2021-02-22 [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Modification date

2021-02-22 (registry last-modified for the 993 rows; not an original allocation date — IANA publishes no creation date for this entry) [Confirmed] — IANA registry

Related ports

143/tcp (imap, cleartext + STARTTLS), 585 (historical imap4-ssl, deprecated), 220 (imap3); contrast 993/tcp (imaps)

Primary use

none — 993/udp has no active protocol; the IANA entry is Reserved, with no UDP transport defined by RFC 9051

Common software

none on UDP; all IMAPS clients/servers (Dovecot, Courier, Thunderbird, Apple Mail, Outlook) use TCP/993

Security implications

legitimate exposure on 993/udp is effectively zero; a responding host is anomalous and warrants investigation. Documented "port 993" threat activity (e.g., Tofsee IMAP C2) is TCP-only; no research documents 993/udp-specific malware or C2

TCP sibling (993/tcp)

imaps — IMAP over Implicit TLS, assignee [IESG], contact [IETF_Chair], references [RFC3501][RFC8314][RFC9051], modified 2021-02-22 [Confirmed] — IANA registry

Registry-source note

one plain-text CSV fetch returned only the TCP row; the HTML registry clearly shows the second UDP row marked Reserved with the same RFC 9051 reference — the HTML result is authoritative [Confirmed] — IANA registry (HTML vs CSV)

Analyst note

Treat any open/responsive 993/udp as anomalous — there is no standard service to explain it. The well-known IMAPS service lives on 993/tcp only.