IMAP server meaning: the mail server that lets every app, including your sales tools, read the same inbox.

Definition

An IMAP server is a mail server that runs the Internet Message Access Protocol (IMAP), the standard that lets an email client read and manage messages that stay stored on the server.

The current version is IMAP4rev2, published by the IETF as RFC 9051 in August 2021. It describes IMAP as a way for a client to access and manipulate mail on a server, with remote folders that work like local ones, and with a way for an offline client to resynchronize later.

The practical result: your email inbox lives in one place. Your phone, your laptop, webmail and any sales tool you connect all ask the same IMAP server what is in the mailbox, so an email read, moved or deleted on one of those devices looks the same on all of them.

IMAP server meaning, in plain terms

The IMAP server meaning is easiest to see from what it replaced. POP3, the older protocol, was designed so that mail is normally downloaded and then deleted from the server. An IMAP server works the other way: the server keeps the master copy, and every email client is a window onto it.

• Storage: messages, attachments and folders are kept on the mail server, not only on a device.
• Sync: flags such as read, answered and flagged are stored on the server, so every connected app shows the same state.
• Remote work on mail: the client can search, fetch only headers or one part of a message, create and rename folders, and move messages without downloading the whole mailbox.
• Offline and back: a client can work offline and resynchronize when it reconnects.

What an IMAP server does not do is send email. RFC 9051 says so directly: posting mail is handled by a mail submission protocol such as the one in RFC 6409, which is SMTP-based. That split matters when you connect a mailbox to a sales tool, because reading and sending are two separate permissions.

What an IMAP account means

An IMAP account is simply an email account that an app reaches through an IMAP server. The account has a username, usually your full email address, a server name, a port and a sign-in method. The same mailbox can be an IMAP account in one app and a webmail account in the browser.

Advantages and limits of an IMAP server

How an IMAP server works

An IMAP session is a conversation between the email client and the server over a TCP connection. The client sends tagged commands, the server answers with data and a completion result, and the client acts on what it learns.

RFC 9051 defines four connection states: not authenticated, authenticated, selected and logout. Most commands are only valid in certain states, which is why a client must sign in before it can open a mailbox, and must open a mailbox before it can touch messages.

The IMAP commands behind every email app

The IDLE command lets the server tell the client about new messages, deletions and flag changes as they happen, instead of the client polling. It was an extension in the older IMAP4rev1 and is part of the core protocol in IMAP4rev2, along with MOVE.

Every message in a mailbox has a unique identifier (UID). Clients and sales tools can use it to remember which messages they already processed, so they pick up where they left off after a disconnect.

RFC 9051 also says the plain LOGIN command, which carries a password, should be used only as a last resort after AUTHENTICATE fails. That line in the standard is the protocol side of the move to OAuth described further down.

IMAP4rev1 and IMAP4rev2: the versions behind the standard

From 2003 to 2021 the reference text was RFC 3501, IMAP4rev1, published in March 2003. It replaced an earlier version, RFC 2060. RFC 9051 obsoleted RFC 3501 in 2021 and became the current standard for an IMAP server.

• Extensions folded in: IDLE, MOVE, NAMESPACE, UNSELECT, UIDPLUS, ENABLE and the special-use mailbox attributes, among others, are now part of the base protocol.
• UTF-8: mailbox names and message headers may use UTF-8.
• Removed or deprecated: the CHECK command was removed, and the \Recent flag and LSUB command were deprecated.
• New keywords: servers should support $Forwarded, $MDNSent, $Junk, $NotJunk and $Phishing.

An IMAP server can advertise both IMAP4rev1 and IMAP4rev2 in its CAPABILITY response. A client that wants the newer behavior then issues ENABLE IMAP4rev2. For users, the version is invisible; for a tool vendor, it decides which features the connection can rely on.

What an IMAP server keeps in sync

The sync that makes IMAP useful runs on flags stored with each message on the server. RFC 9051 defines a set of system flags that every client understands.

Folders sync the same way. Google's Gmail Help says that when you add Gmail to another email client, your messages and labels are synced with that client.

Special-use folders: Sent, Drafts, Junk and Trash

RFC 9051 lets a server mark the role of a mailbox with attributes such as \Sent, \Drafts, \Junk, \Trash, \Archive and \All. The folder names users see can differ between providers; the attribute tells a client which folder plays which role.

This matters to sales tools in a concrete way. A tool that logs your outreach has to find the folder that holds sent mail, and a tool that checks for replies should not mistake the Junk folder for the inbox. All special-use attributes are optional, so some servers expose none.

IMAP vs POP3: which one to use

POP3, the Post Office Protocol version 3, is the older way to receive email. RFC 1939 describes it as a way for a workstation to retrieve mail a server is holding, and notes that normally mail is downloaded and then deleted. IMAP was built for managing mail on the server instead.

Microsoft's own comparison makes the same point: POP3 was originally designed for use on one computer and supports only one-way sync. It adds that sent items cannot be synchronized using POP3, and that folders made on one device must be made again on every other device.

For anyone who reads email on a phone and a laptop, or connects a mailbox to a CRM, IMAP vs POP3 is not a close call. Multiple devices and multiple tools need one shared copy of the mailbox, and only IMAP provides it.

POP3 still has a place for a single device that must keep an offline archive, or for a server that only collects mail into another system. Gmail and Outlook.com both still offer POP3 servers alongside their IMAP servers.

SMTP vs IMAP: sending and reading

SMTP and IMAP are the two halves of an email account. SMTP (Simple Mail Transfer Protocol) takes a message from your app and delivers it toward the recipient. IMAP lets your app read the mailbox where incoming mail, and usually a copy of sent mail, is stored.

The last row is the one that hurts. When IMAP breaks but SMTP still works, a sequencing tool can keep sending follow-ups to people who already replied, which is exactly the email a prospect remembers.

Where IMAP fits among the email protocols

IMAP runs over a reliable connection such as TCP, as RFC 9051 puts it, and RFC 8314 asks for that connection to be encrypted with TLS. Three email protocols share the work between email servers and the email clients that users run on their devices.

• SMTP: email clients submit outgoing emails to their provider's server, normally on port 587, and email servers relay messages to each other over port 25, according to RFC 6409.
• IMAP: email clients access emails stored on the provider's IMAP server, with support for folders, search and sync across multiple devices.
• POP3: email clients download emails from the server to one device, usually for offline access.

An email service such as Gmail or Outlook.com runs servers for all three. Users rarely see them, except in the settings screen of an email client or a sales tool, where each server name, port and security option has to be entered correctly for email data to flow.

IMAP server vs MX records: two different jobs

People setting up a domain often confuse the IMAP server with the mail exchanger. They sit at opposite ends of the same mailbox. MX records are DNS entries that tell other mail servers where to deliver inbound mail for your domain; RFC 8314 mentions them only as the way to handle inbound mail.

The IMAP server is where your own apps go to read that mail once it has arrived. RFC 8314 recommends a different DNS record type, SRV records, to help email clients discover the right IMAP and submission servers automatically.

IMAP ports 143 and 993, and the other mail ports

RFC 9051 says an IMAP server listens on port 143, the cleartext port, or port 993, the implicit TLS port. On 993 the encrypted connection starts immediately. On 143 the connection starts unencrypted and the client must issue STARTTLS before signing in.

RFC 8314, titled Cleartext Considered Obsolete, recommends implicit TLS for mail access in preference to STARTTLS, and asks providers to deprecate cleartext access as soon as practicable. Gmail, Outlook.com and Yahoo Mail all publish port 993 with SSL/TLS for IMAP.

IMAP server examples: Gmail, Outlook.com and Yahoo Mail

An IMAP server address is a host name your app connects to. The three examples below come from each provider's own help pages, read on Oct 1, 2026. Check the page again before you rely on it, because providers change these settings.

For a company domain, the IMAP server is whatever the domain's mail host publishes. Check the mail host's own documentation or ask your administrator for the server name, port and sign-in method, rather than copying values from a forum post.

IMAP server settings for Gmail

Google publishes the server names in its developer documentation. For personal Gmail accounts, Google says that starting January 2025 the Enable IMAP and Disable IMAP choice is no longer available: IMAP access is always on.

Gmail no longer supports third-party apps that require your Google username and password. If a tool only offers a password field and "Username and password not accepted" appears, look for a "Sign in with Google" option instead.

Three Gmail details matter for sales tools. Sent messages are copied to the Sent folder automatically when a client sends through Gmail's SMTP, so a tool should not save a second copy. Google suggests limiting IMAP folders to 10,000 emails or fewer if a client crashes or syncs slowly.

The third is deletion. Google warns that if a client is set to save deleted messages in the Trash, anything deleted from that client is permanently deleted from Gmail after 30 days. A tool that "cleans up" processed replies can therefore remove them for good.

IMAP server settings for Outlook and Microsoft 365

For Outlook.com accounts, Microsoft lists the settings below and states that Outlook.com requires Modern Auth, meaning OAuth2. POP and IMAP access is disabled by default and has to be turned on under Settings, Mail, Forwarding and IMAP.

For work mailboxes on Exchange Online, Microsoft says Basic authentication is now disabled in all tenants, including for IMAP and POP, and that no one can re-enable it. Microsoft adds that this also prevents app passwords with apps that do not support two-step verification.

Developers whose apps read mail over IMAP can keep the protocol but must use Modern authentication, which is OAuth 2.0. In practice, a tool that connects to a Microsoft 365 mailbox by IMAP signs in through Microsoft's own page rather than storing your password.

Whether you may approve that tool yourself depends on your company. Microsoft Entra lets users consent to an app accessing their own mailbox by default, and lets administrators restrict that. Ask IT before you try, not after the connection fails.

App passwords and OAuth: how you sign in to an IMAP server

How the tool proves it may read your mailbox has changed more than the protocol itself. There are three ways, and the providers now push toward the last one.

Google's own guidance is blunt: app passwords are not recommended and are unnecessary in most cases. Use OAuth whenever the tool offers it, and treat an app password as the fallback for software that has no other option.

One OAuth detail is worth knowing. Microsoft notes that if you approve the offline_access scope, the app receives refresh tokens, which are long-lived and let it get new access tokens as old ones expire. A connected tool keeps access until you or an administrator revoke it.

Why sales tools connect to a mailbox via IMAP

A sales cadence only works if the tool knows who answered. The replies land in your inbox, not in the tool, so the tool needs to read the mailbox. That is the reason a sequencing tool or CRM asks for IMAP access, or for the provider's equivalent API access.

• Reply detection: the tool matches incoming messages to the prospect and can stop the remaining steps, so nobody gets a follow-up after saying yes or no.
• Bounce handling: email bounces come back to the mailbox as messages. Reading them lets a tool mark the address as bad before it sends again.
• Auto-replies: out-of-office messages can be sorted so a vacation notice does not count as a real reply.
• Activity logging: the CRM attaches the conversation to the right contact and account, so the next person sees the history.
• Shared context: a manager or teammate sees the thread without being copied on every message.

This is why a broken connection is so costly in cold email. The emails keep going out, the replies are not seen, and the sequence follows up with people who already answered. The same applies to any multi-step outreach sequence.

What a sales tool can see with IMAP access

IMAP itself has no concept of "only sales email". Once an app is authenticated, it works with the mailboxes the account can open. The permission is the mailbox, and the tool's own settings decide what it actually processes.

On Microsoft 365, the IMAP permission a tool requests is named IMAP.AccessAsUser.All, which describes its reach accurately: access to the mailbox as the user. Read the consent screen before approving it, the same way you would read a contract before signing it.

What one CRM's documentation discloses

HubSpot's Knowledge Base is a useful example because it spells the access out. It says you can connect Gmail, Microsoft Outlook, Microsoft Exchange, or other email accounts using IMAP, so the CRM can send one-to-one emails, log emails and send sequences.

• Over IMAP: HubSpot says it gets access only to the email address, password, server information, email metadata and message bodies.
• Through the Gmail integration: HubSpot says it will be able to read, modify, create and send emails from the connected account, and that tracked correspondence is visible to other users in the HubSpot account.
• With two-factor sign-in: the generic IMAP route asks for a third-party app password from your email provider.

Its IT requirements page adds two details that apply to any mailbox connection. HubSpot makes up to five concurrent connections to an IMAP inbox, two of them permanent for the inbox and the sent folder, and the IMAP and SMTP ports must be open and support encryption.

Those connections count toward provider limits such as Gmail's 15 email clients. HubSpot also offers a "Trust any certificate" checkbox for servers without a certificate signed by a certificate authority; this page's advice is to fix the certificate instead of ticking the box.

How to connect a mailbox to a CRM or sequencing tool

The steps below were written for this page and apply across tool categories, from a CRM to an outreach platform or an AI sales agent that sends on your behalf.

1. Check that the tool is approved

   Use a tool your company has approved for mailbox access. On a work account, an administrator may need to approve the app first.

2. Choose the OAuth option

   Pick "Sign in with Google" or "Sign in with Microsoft" instead of a manual IMAP form. The manual form is for providers that do not offer OAuth.

3. Read the permissions

   On the consent screen, note whether the tool requests reading, sending, or both, and whether that matches what you need it to do.

4. Use manual settings only if needed

   For other providers, enter the IMAP server name, port 993, SSL/TLS, your full email address and an app password if the provider issues one.

5. Test with a real reply

   Send yourself a test step from the tool, reply to it from another address, and confirm the tool marks it as replied and stops the sequence.

Troubleshooting IMAP connection errors

When a sales tool shows a disconnected mailbox, pause its sequences before fixing anything. Every hour of broken reply detection is another batch of follow-ups to people who may already have replied.

IMAP server or the provider's API

IMAP is a protocol, not a product. Gmail, Outlook.com, Exchange Online and Yahoo Mail all publish IMAP servers, which is why it works as the universal fallback. Some tools connect to Gmail or Microsoft 365 through the provider's own integration instead, which is a different permission with its own consent screen.

For the user, the difference is mostly invisible. What matters is the same in both cases: sign in with OAuth, read what the tool asks for, and know how to revoke it. For a B2B SaaS buyer, this is part of the security review.

IMAP server security for sales teams

• Encrypt the connection: use port 993 with TLS. RFC 8314 recommends TLS 1.2 or later for all traffic between email clients and mail access servers.
• Never share your real password: OAuth tokens and app passwords can be revoked on their own; your password protects everything else.
• Review connected apps: remove tools you stopped using. In your Google Account, the linked apps page lets you remove an app's access, after which Google says it can no longer access your account.
• Keep sending separate from reading: this page's advice is to grant send permission only to tools that must send, and to watch email deliverability before adding volume to a main mailbox.

Common mistakes with IMAP servers

• Assuming IMAP sends email. It only reads; sending is SMTP or an API, and it needs its own setup.
• Confusing the IMAP server with the MX record, and editing DNS when the real problem is a sign-in setting.
• Using POP3 on a mailbox a sales tool also reads, so one app downloads replies the other never sees.
• Typing your real password into a tool's IMAP form instead of using OAuth.
• Ignoring a "mailbox disconnected" warning while sequences keep sending.
• Saving sent messages twice in Gmail, once by the client and once by Gmail's SMTP.
• Granting full mailbox access to a tool nobody on the team still uses.

Once the mailbox is connected, the next job is the messages themselves: a sales follow-up email template that stops the moment someone replies is the whole point of the connection.

In a sequence

Before a sales tool can read your work mailbox, someone usually approves it. The request below was written for this page: it names the tool category, the permissions and the reason, so an administrator can say yes quickly. More outreach messages are in the sales outreach hub.

Subject: Approval to connect my mailbox to {{toolCategory}}

Hi {{adminName}},

I would like to connect my work mailbox ({{emailAddress}}) to {{toolName}}, the {{toolCategory}} our team uses for {{purpose}}.

It asks for IMAP read access so it can detect replies and stop follow-ups, and {{sendPermission}} so it can send from my address.

It supports OAuth sign-in, so no password is stored in the tool. The permissions it requests are: {{scopes}}.

Could you approve the app, or tell me what you need to review first?

Thanks,
{{senderName}}

Frequently asked questions