IMAP and POP3: retrieving mail

Module 1: How email works · Reading time: 9 minutes

Learning objective: After this lesson, you'll be able to explain how IMAP and POP3 differ, where your mail is stored with each one, and choose the right one for your situation.

Key concepts: IMAP (RFC 9051), POP3 (RFC 1939), mailbox on the server, folders, flags (read, answered, flagged, deleted), synchronising, IDLE (push notification), "leave a copy on the server", local copy, backup

Two ways to get to your mail

In lesson 1.1 you saw that an email eventually ends up in your mailbox on your provider's server. It stays there until you view it. To view it, your mail program needs a way to talk to that server. Two protocols exist for this:

• POP3 (Post Office Protocol version 3, RFC 1939, from 1996). The idea: the server is a letterbox. Your program takes the letters out and carries them home.
• IMAP (Internet Message Access Protocol, now version 4rev2, RFC 9051). The idea: the server is a filing cabinet. Your program looks in the cabinet, and whatever you do (read, move, delete) happens in the cabinet itself.

POP3: fetch and take with you

With POP3, your program connects, asks "which messages are there?", downloads them and then asks the server to (usually) delete them. POP3 only knows one folder on the server: the Inbox. Folders you create in your program only exist on your own computer. Your sent mail, too, is stored only on the device you used to send it.

Consequences:

• If you read mail on your phone with POP3, it's then gone from the server. Your laptop will never see it.
• If your computer breaks or is stolen without a backup, you lose your mail. The server no longer has it.
• Your mailbox on the server stays small. That used to be the big advantage, back when storage was expensive.

Many programs have the option leave a copy of messages on the server (sometimes with "delete after x days"). Then each device fetches its own copy, but still without folders, without shared "read" status, and without sent mail on the server. It's a workaround, not a solution.

IMAP: looking in the cabinet

With IMAP, everything stays on the server. Your program shows an overview, fetches a message when you open it (and usually keeps a copy so you can read offline), and sends every action back to the server:

• Folders live on the server: Inbox, Sent, Drafts, Trash, Spam and your own folders. Your phone, your laptop and webmail all see the same folders.
• Flags live on the server: read, answered, flagged, deleted. Read an email on your phone, and it's read on your laptop too.
• Sent mail is placed by your program as a copy in the Sent folder on the server. Note: the mail program does this itself, not the SMTP server. That's why you sometimes see two folders, "Sent" and another name, if two programs label it differently (lesson 3.1).
• With IDLE (an IMAP extension), your program keeps the connection open and the server notifies it immediately when new mail arrives. This gives you an almost instant notification, without your phone having to ask every minute.

The downside: everything counts towards the storage of your mailbox on the server. Lesson 3.2 explains how to manage that.

Deleting works differently than you'd think

With IMAP, "deleting" happens in two steps. A message first gets the flag \Deleted. Only at expunge (purge, compact, "clean up folder") is it really gone. Most programs move a deleted message to Trash and erase it there later. Some older settings leave the message in the folder with strikethrough text. If you see mail with strikethrough, that's how your program is set up; "compact folder" or "erase deleted messages" will clear them out.

With POP3, deleting is local: gone from your computer, but possibly still on the server if you had "leave copy on server" switched on.

Don't mix them

The most dangerous situation is a mix: the computer at the office uses POP3 (and fetches everything from the server), while the phone uses IMAP. Then the phone sometimes sees mail and sometimes doesn't, depending on whether the office computer has already fetched it. This looks like "mail is disappearing" and generates a lot of support questions. The solution is always: IMAP on all devices.

Switching from POP3 to IMAP works like this: add the address again as an IMAP account, drag the old mail from the POP3 folders into the IMAP folders (this uploads it to the server; watch your storage space), and then remove the POP3 account. "Converting" an existing account isn't possible in most programs.

Which one do you choose?

A few misunderstandings:

• "IMAP is insecure because everything is on the server." The server is usually better secured and better backed up than your laptop. A strong password matters more (lesson 3.4).
• "With POP3, nobody can get to my mail." The mail was on the server until you fetched it, and now sits on your laptop. Whoever has your laptop has your mail.
• "Calendar and contacts also go via IMAP." No. IMAP is mail only. Calendars and contacts go via other protocols (CalDAV/CardDAV, or Exchange/ActiveSync with Microsoft). This matters during a move (lesson 8.1).

The ports

Both protocols have an encrypted port and an old unencrypted port:

Always use 993 or 995. You can read why, and what STARTTLS is, in lesson 1.4.

In practice: what this looks like with a mailbox

With a WebOké mailbox, you choose IMAP with port 993 (SSL/TLS), or POP3 with port 995, in your mail program. Webmail also works directly on the IMAP mailbox: everything you do there shows up in your program if it uses IMAP. Other providers work in a similar way; there too, the ports are usually listed in the welcome email or customer panel.

Summary

• POP3 fetches mail from the server to one device; IMAP keeps everything on the server and synchronises folders and status.
• With IMAP, you see the same thing on all your devices and in webmail; your provider can make a backup.
• Never mix POP3 and IMAP for the same mailbox.
• Deleting with IMAP happens in two steps: flagging and erasing (expunge).
• IMAP is only about mail, not calendar and contacts.

Quiz

Exercise

Exercise O1.3: Mapping out your situation. Make a list of all the devices and programs you use to read your mail (computer, phone, tablet, webmail, a colleague). Look up for each device whether it uses IMAP or POP3 and which port. Then answer: do you use the same protocol everywhere? What happens to your mail if your laptop breaks tomorrow? The program saves your answers and then shows the criteria.

Further reading

The steps in these articles apply to WebOké's panels; with other providers it works in a similar way.

• DirectAdmin guide 8.7: IMAP or POP3: what's the difference?
• What is IMAP or POP3 and how does it work?
• How do I delete a message in IMAP?
• RFC 9051 (IMAP4rev2), RFC 1939 (POP3), RFC 2177 (IMAP IDLE)