Common attacks and weaknesses
- Passwords sent in clear text.
- Password spraying (legacy authentication bypasses MFA).
Port 143: IMAP
Mailbox access protocol. Clear text unless STARTTLS is used.
143
How IMAP works
EmailThe mail client connects to port 143 to download or sync the messages waiting in the mailbox. Encryption is optional: it only happens if both sides negotiate TLS (STARTTLS).
- Transport
- TCP
- Exposure risk
- 6/10 high if reachable from the Internet
- Encryption
- Optional TLSTLS only if negotiated
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
Is port 143 dangerous?
How to secure it
- Use IMAPS (993).
- Disable legacy authentication where MFA is required.
IANA registry entries for port 143
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| imap | 143 | TCP | Internet Message Access Protocol | RFC 3501, RFC 9051 | 2021-02-22 |
| - | 143 | - | Reserved | - | - |
// source: IANA service name and port number registry
Which program uses port 143, and is it reachable?
Linux
sudo ss -ltnup 'sport = :143' # process listening on 143
sudo lsof -nP -i :143macOS
sudo lsof -nP -i :143
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 143 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 143 netstat -ano | findstr :143
From another machine
nmap -p 143 -sV <host> nc -zv <host> 143
Block it in the firewall
sudo ufw deny 143/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 143" -Direction Inbound -LocalPort 143 -Protocol TCP -Action Block # Windows
What is port 143 used for?
Mailbox access protocol. Clear text unless STARTTLS is used.
Is port 143 TCP or UDP?
Port 143 is registered for TCP.
Is it safe to open port 143?
It is rated 6/10 (high) when exposed to the Internet. Passwords sent in clear text. Use IMAPS (993).
How do I check if port 143 is open?
On Linux run "ss -ltnup 'sport = :143'", on macOS "lsof -nP -i :143", and on Windows "netstat -ano | findstr :143" to see the local process. From another machine, "nmap -p 143 <host>" shows whether it is reachable.