Exchange mail flow guides › Inbound: POP3 and IMAP retrieval into Exchange

POP3 or IMAP for retrieving provider mailboxes into Exchange? Ports, TLS, leave-on-server and OAuth2

For a connector that empties a provider mailbox into Exchange, POP3 and IMAP deliver the same messages; the choice is driven by what the provider allows (Microsoft 365 and Gmail take IMAP with OAuth2 for modern authentication), whether other clients also read the mailbox, and the TLS port conventions — 995 for POP3 over TLS, 993 for IMAP over TLS. This guide sets the two protocols side by side as a connector uses them, explains how the encryption setting and the port belong together, what happens to the copy at the provider, and which protocol the two large cloud providers effectively decide for you.

Updated on 2026-09-25

What the two protocols do differently, and what a connector needs from them

Microsoft’s own summary of the two protocols, written for mail clients, is a fair starting point (POP3 and IMAP4 in Exchange Online): by default POP3 clients remove downloaded messages from the server, though they can typically be configured to keep copies; POP3 downloads into a single folder and cannot synchronise several server folders; IMAP4 clients by default leave downloaded messages on the server and can create and access multiple folders there, and most of them can show senders and subjects before downloading a whole message.

A connector that feeds an on-premises Exchange Server uses very little of that. It logs in to the provider mailbox on a schedule, downloads what is new, hands each message to Exchange over SMTP and then either deletes the copy at the provider or leaves it there. It does not build a folder tree, and Outlook users never see the provider mailbox at all — they see their Exchange mailbox. So the folder features that make IMAP attractive for a mail client hardly matter for a connector, and three other things matter more:

• What the provider still lets you log in with. Microsoft 365 and Google no longer accept a username and password from an application for mailbox access; both need OAuth 2.0, and the two POPcon walkthroughs for them use IMAP on port 993. That decides the protocol before any other consideration.
• Whether the mailbox has other readers. If a phone or a webmail user still reads the same provider mailbox, the messages must remain there for a while after the connector has taken its copy. Both protocols allow that in the connector; IMAP’s default behaviour, as Microsoft describes it, already matches that expectation.
• The port and encryption combination the provider expects. This is where most first-connection failures come from, and it is the same question for both protocols.

	POP3	IMAP
Plain port	110	143
Port over TLS	995 (server type POP3-SSL)	993 (server type IMAP-SSL)
Encryption on the plain port	STLS (STARTTLS), upgrades the connection	STLS (STARTTLS), upgrades the connection
Copy at the provider after download (Microsoft’s client default)	Removed	Left on the server
Copy at the provider after download (in the connector)	Per account: delete, leave indefinitely, or leave N days	Per account: delete, leave indefinitely, or leave N days
Folders on the server	One folder	Several; a connector reads the inbox
OAuth 2.0 at Microsoft 365 in the POPcon walkthrough	Not available for Microsoft accounts, per the walkthrough	outlook.office365.com, 993, OAuth2 Microsoft
OAuth 2.0 at Gmail / Google Workspace in the POPcon walkthrough	Legacy article only (pop.gmail.com, 995, password or app password)	imap.gmail.com, 993, OAuth2 Google
Catch-all or single-user distribution, schedule, size of a download pass	Same account settings	Same account settings

Ports and encryption: the setting must match the port

The four server types in the connector carry the four standard ports: POP3 on 110, POP3-SSL on 995, IMAP on 143 and IMAP-SSL on 993 (POP3/IMAP configuration settings). The encryption field on the account has four values, and two of them belong to a specific kind of port (Account details):

• TLS — Transport Layer Security, implicit: the connection is encrypted from the first byte and is made on the SSL port, 995 or 993.
• SSL — the legacy predecessor, also on the SSL port.
• STLS — STARTTLS: the connection starts unencrypted on the plain port, 110 or 143, and is upgraded to encrypted.
• SPA — Secure Password Authentication, an authentication option rather than transport encryption.

The combinations that work are therefore TLS with 995 or 993 and STLS with 110 or 143. A server that expects an implicit TLS handshake on 995 will not understand a client that opens the connection in plain text and then asks to upgrade, and a server that expects plain text on 110 will not understand a client that starts with a TLS handshake; in both cases the login fails or the connection times out before any mail is read. If a first connection to a provider fails, check this pairing before anything else. POPcon supports TLS 1.2 and 1.3 and both variants, STARTTLS and implicit TLS.

Server type	Port	Encryption setting
POP3-SSL	995	TLS (implicit)
IMAP-SSL	993	TLS (implicit)
POP3	110	STLS (STARTTLS), where the provider offers it
IMAP	143	STLS (STARTTLS), where the provider offers it

The Test access button on the account checks the server connection, the authentication and the mailbox access in one go; it is the quickest way to confirm the pairing, and the timeout for a server response defaults to 180 seconds.

Leave on the server, or delete?

Microsoft describes the client defaults — POP3 removes, IMAP4 leaves — but in a connector the behaviour is chosen per account and is the same for both server types (delete / keep options):

• Delete emails from server — messages are removed immediately after a successful download. The provider mailbox stays empty; Exchange is the only copy.
• Leave emails on server indefinitely — the connector never deletes. The connector tracks which messages it has already processed, so nothing is delivered to Exchange twice.
• Leave emails on server for N days — messages stay for the given number of days and are then deleted. This is the window for other clients that also retrieve the same messages, and the usual setting during a migration, when the old client is still in use for a few days.

Which one to choose has nothing to do with the protocol: if the connector is the only reader of the mailbox, delete after download keeps the provider mailbox from filling up; if a phone or webmail still reads it, leave the messages for as many days as that reader needs. With a catch-all mailbox for the whole domain the same setting applies to every recipient’s mail in that mailbox; the guide Catch-all (multidrop) mailbox vs one POP3 mailbox per user covers that choice.

What the provider decides

Provider	Protocol, server, port	Authentication	Source
Microsoft 365 / Exchange Online	IMAP, outlook.office365.com, 993. Microsoft also documents POP3 on 995; the POPcon walkthrough uses IMAP and says POP3 with OAuth2 is not available there for Microsoft accounts.	OAuth2 Microsoft (Basic authentication for POP and IMAP is switched off)	Microsoft Learn; KB walkthrough; guide Basic authentication is gone
Gmail / Google Workspace	IMAP, imap.gmail.com, 993. Google still documents POP on pop.gmail.com, 995; the POPcon OAuth2 walkthrough is written for IMAP.	OAuth2 Google (Workspace refuses a username and password from an app since 1 May 2025)	KB walkthrough; guide Gmail into Exchange over IMAP with OAuth2
IONOS, Strato, GMX and other providers that accept a password	POP3-SSL on 995 or IMAP-SSL on 993, whichever the provider’s help page lists for mail programs; the exact host names and any provider-specific rules are not reproduced here.	Username and password (Standard)	The provider’s own settings page; setup steps in How to download POP3 and IMAP mailboxes into Exchange

Two rules fall out of the table. Where the provider requires OAuth 2.0, the walkthrough decides the protocol and it is IMAP over TLS on 993. Where the provider still takes a password, either server type works and the decision comes down to the leave-on-server question above; POP3-SSL on 995 is the conventional choice for a mailbox that the connector alone empties, IMAP-SSL on 993 for a mailbox that other clients keep reading. In both cases the encrypted port is the one to take — the plain ports exist for STARTTLS, not for unencrypted logins across the internet.

Symptoms, and what each one really means

What you see	Cause	What to do
The login fails or times out on port 995 or 993 although the password is correct	Encryption setting and port do not match: STLS selected on an SSL port, or TLS selected on a plain port	Set TLS with 995/993 or STLS with 110/143 and run Test access.
A Microsoft 365 mailbox refuses the login with a correct password	Basic authentication for POP and IMAP is switched off in Exchange Online	Set the account to IMAP, outlook.office365.com, 993, authentication OAuth2 Microsoft; see the Microsoft 365 guide.
A Google Workspace mailbox refuses the login with a correct password	Google no longer accepts a username and password from a third-party app	Set the account to IMAP, imap.gmail.com, 993, authentication OAuth2 Google; see the Gmail guide.
Mail arrives in Exchange but stays in the provider mailbox as well	The account is set to leave messages on the server	Intended while other clients read the mailbox; otherwise switch the account to delete after download.
Mail is downloaded correctly but never reaches Exchange	Not a POP3/IMAP question: the SMTP delivery into Exchange fails	Check the receive connector as in the setup guide and the article POPcon downloads email but cannot reach my Exchange server.

Frequently asked questions

More in the Exchange mail flow guides, on the POPcon product page, the download page or in the knowledge base. Auf Deutsch: POP3 oder IMAP für die Abholung von Provider-Postfächern nach Exchange?.