# IMAP vs POP3 vs Exchange: what's the difference and which should you use?

URL: https://iblockspam.com/blog/imap-vs-pop3-vs-exchange
Last updated: 2026-11-03
Published: 2026-11-03
Topic: Email security basics
Author: iBlockSpam Team

> IMAP vs POP3 vs Exchange explained: where your mail is stored, what syncs, ports and server settings, security and sign-in changes, and which to pick in 2026.

## Short answer

POP3 downloads mail to one device and usually deletes it from the server. IMAP keeps mail and folders on the server and syncs them to every device. Exchange (ActiveSync or MAPI) syncs mail plus calendar, contacts and tasks. For Microsoft 365 use Exchange; for other hosts use IMAP over TLS on port 993. Use POP3 only for a single device.

When you add an email account to a mail app, it usually asks you to choose: IMAP, POP3 or Exchange. The choice decides where your email lives, whether your folders and sent mail follow you between devices, and whether your calendar comes along. It also affects security, because some of these protocols no longer accept a plain password at major providers. This guide explains each option in plain terms and tells you which to pick.

## What is the difference between IMAP, POP3 and Exchange?

IMAP, POP3 and Exchange are three ways for a mail app to read a mailbox on a server. POP3 downloads messages to one device. IMAP keeps everything on the server and keeps every device in sync. Exchange protocols sync mail together with calendar, contacts and tasks for Exchange and Microsoft 365 mailboxes.

None of them sends mail. Microsoft puts it plainly: POP3 and IMAP4 "email programs don't use POP3 and IMAP4 to send messages," and instead "rely on SMTP to send messages." See [what is SMTP](https://iblockspam.com/blog/what-is-smtp) for that side.

| | POP3 | IMAP | Exchange (ActiveSync or MAPI) |
|---|---|---|---|
| Standard | [RFC 1939](https://www.rfc-editor.org/rfc/rfc1939.html) | [RFC 9051](https://www.rfc-editor.org/rfc/rfc9051.html) (IMAP4rev2) | Microsoft protocols |
| Where mail lives | Downloaded to the device; usually deleted from server | On the server; devices keep a synced copy | On the server; devices keep a synced copy |
| Folders | Inbox only | All server folders, including Sent and Junk | All folders |
| Calendar, contacts, tasks | No | No | Yes |
| Multiple devices | Poor | Good | Good |
| Secure ports | 995 (implicit TLS) | 993 (implicit TLS) | HTTPS (443) |
| Works with | Almost any mail host | Almost any mail host | Microsoft 365, Exchange Online, Exchange Server |
| Best for | One device, offline archive | Most non-Microsoft mailboxes | Microsoft 365 and Exchange mailboxes |

## What is POP3?

POP3 (Post Office Protocol version 3) is a protocol that lets a mail app download messages from a server mailbox, usually removing them from the server afterward. [RFC 1939](https://www.rfc-editor.org/rfc/rfc1939.html), published in 1996, says POP3 "is not intended to provide extensive manipulation operations of mail on the server; normally, mail is downloaded and then deleted."

That design made sense for computers that were online for a few minutes at a time. It works badly for a person with a laptop, a phone and webmail. Microsoft's [Exchange Online documentation](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/pop3-and-imap4/pop3-and-imap4) lists the limits:

- "By default, POP3 clients remove downloaded messages from the email server," which makes it "difficult to access email on multiple computers."
- POP3 clients "download messages to a single folder on the client computer (typically, the Inbox)."
- POP3 "can't synchronize multiple folders on the email server with multiple folders on the client computer."

The single-folder rule has a security side effect. If your provider's spam filter puts a message in the server's Junk folder, a POP3 app never sees it. You won't notice a false positive unless you sign in to webmail. Messages a [quarantine](https://iblockspam.com/blog/what-is-email-quarantine) holds are likewise reached through the quarantine's own interface or digest, not through POP3.

POP3 listens on TCP port 110 for cleartext connections. [RFC 8314](https://www.rfc-editor.org/rfc/rfc8314.html) specifies implicit TLS on port 995, where "a TLS handshake begins immediately."

## What is IMAP?

IMAP (Internet Message Access Protocol) is a protocol that lets a mail app read and manage messages that stay on the server, with the same folders on every device. The current version, IMAP4rev2, is [RFC 9051](https://www.rfc-editor.org/rfc/rfc9051.html) from August 2021, which obsoletes RFC 3501. It says IMAP "permits manipulation of mailboxes (remote message folders) in a way that is functionally equivalent to local folders," and lets an offline client "resynchronize with the server."

In practice that means:

- Read a message on your phone and it shows as read on your laptop.
- Move a message to a folder and the move happens on the server.
- Sent items and drafts can be stored on the server for every device. Microsoft notes "most IMAP4 clients can be configured to keep a copy of sent items on the server."
- New mail can appear in near real time. Microsoft says that if a client supports "the IMAP4 IDLE command, email transfers ... might occur in nearly real time."

IMAP doesn't carry calendars or contacts. Providers handle those separately, for example through CalDAV and CardDAV or their own apps.

IMAP uses port 143 for cleartext with optional STARTTLS, and port 993 for implicit TLS. RFC 9051 itself names both: "port 143 (cleartext port) or port 993 (Implicit TLS port)."

## What does Exchange mean in mail app settings?

"Exchange" in an account setup screen means connecting with Microsoft's own protocols instead of IMAP or POP3. These protocols work with Microsoft 365, Exchange Online and on-premises Exchange Server, and they sync mail, calendar, contacts and tasks together. Which protocol is used depends on the app:

- **Exchange ActiveSync (EAS)** is what phones and tablets use. Microsoft describes it as "a client protocol that lets users synchronize a mobile device with their Exchange mailbox," and says it's enabled by default for new mailboxes.
- **MAPI over HTTP** is what Outlook for Windows uses. Microsoft's [basic authentication page](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online) says Outlook for Windows "uses MAPI over HTTP, EWS, and OAB" and that "all of these protocols support Modern authentication."
- **Exchange Web Services (EWS)** is an older API used by some apps. At the time of writing (November 2026), Microsoft is retiring EWS in Exchange Online: its plan starts blocking EWS by default from October 1, 2026 in tenants that haven't explicitly kept it on, with an allow list for specific apps, and Microsoft's [Exchange team blog](https://techcommunity.microsoft.com/blog/exchange/exchange-online-ews-your-time-is-almost-up/4492361) says that "starting with April 1, 2027, EWS will be fully and permanently disabled." The same post says "there are no changes to EWS in Exchange Server."

All of these Exchange protocols run over HTTPS. Microsoft's [URLs and IP address ranges](https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges) list for Exchange Online gives `outlook.office365.com` on TCP ports 80 and 443, and lists IMAP, POP and SMTP separately on ports 143, 587, 993 and 995.

You'll also see Microsoft Graph and the new Outlook, which use Microsoft's cloud APIs rather than any of the above. For a user, the rule is the same: choose the Microsoft 365 or Exchange account type, not IMAP or POP3.

## Which should you use: IMAP, POP3 or Exchange?

Pick based on where your mailbox is hosted and how many devices you use:

1. **Microsoft 365 or Exchange mailbox:** use the Exchange or Microsoft 365 account type in Outlook, Outlook mobile or your phone's mail app. Microsoft says POP3 and IMAP4 "don't offer rich email, calendaring, and contact management," and it has "no plan for Outlook clients to support OAuth for POP and IMAP."
2. **Google Workspace or Gmail:** use the Gmail app, or add it in your mail app as a Google account so it signs in with OAuth ("Sign in with Google"). For personal Google Accounts, [Gmail Help](https://support.google.com/mail/answer/7126229) says that from January 2025 "IMAP access is always turned on in Gmail"; Workspace admins can still turn it off, as shown below.
3. **Any other host (cPanel, a web host, an ISP mailbox):** use IMAP on port 993 with SSL/TLS.
4. **One computer, and you want mail off the server:** POP3 on port 995 is acceptable, for example for an archive mailbox. Turn on "leave a copy on server" if anyone else needs the messages.
5. **An app or device that reads a mailbox automatically:** use IMAP or POP3 with OAuth 2.0, or the provider's API. Ask the vendor if it still asks for a plain password.

## What are the server settings for IMAP, POP3 and SMTP?

These are the published settings for the two largest business platforms. Other hosts publish their own; check your provider's help pages.

| Provider | IMAP | POP3 | SMTP (sending) | Source |
|---|---|---|---|---|
| Microsoft 365 (Exchange Online) | `outlook.office365.com`, port 993, SSL/TLS | `outlook.office365.com`, port 995, SSL/TLS | `smtp.office365.com`, port 587, STARTTLS | [Microsoft Learn](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/pop3-and-imap4/pop3-and-imap4) |
| Gmail and Google Workspace | `imap.gmail.com`, port 993, SSL/TLS | `pop.gmail.com`, port 995, SSL/TLS | `smtp.gmail.com`, port 465 (SSL/TLS) or 587 (STARTTLS) | [Google for Developers](https://developers.google.com/workspace/gmail/imap/imap-smtp) |

For more on outgoing settings, see [SMTP ports 25, 587 and 465](https://iblockspam.com/blog/smtp-ports-25-587-465) and [Gmail SMTP server settings and app passwords](https://iblockspam.com/blog/gmail-smtp-server-settings-app-passwords).

## Are IMAP and POP3 secure?

IMAP and POP3 are secure enough when they use TLS and modern sign-in, and risky when they accept a plain password. The protocols were designed before multifactor authentication existed, so with basic authentication an attacker who guesses or steals a password can download a whole mailbox without ever facing an MFA prompt.

The big providers have closed that door:

- **Microsoft 365.** Microsoft "removed the ability to use Basic authentication in Exchange Online for Exchange ActiveSync (EAS), POP, IMAP," and other protocols, and says "no one (you or Microsoft support) can re-enable Basic authentication." POP and IMAP now need OAuth 2.0. Microsoft also notes that if security defaults are on, "POP3 and IMAP4 are automatically disabled."
- **Google.** Gmail "no longer supports third-party apps or devices" that ask for your username and password. Google's [admin help](https://knowledge.workspace.google.com/admin/gmail/send-email-from-a-printer-scanner-or-app) says that starting May 1, 2025, Workspace accounts no longer support less secure apps, so apps must use OAuth ("Sign in with Google").
- **Encryption in transit.** [RFC 8314](https://www.rfc-editor.org/rfc/rfc8314.html) recommends implicit TLS "for POP, IMAP, SMTP Submission," and says providers "SHOULD advertise servers that support Implicit TLS in preference to servers that support cleartext and/or STARTTLS."

Attackers also use IMAP and POP after they take over an account, connecting a mail client to quietly copy everything. That's why [Google Workspace account recovery](https://iblockspam.com/blog/google-workspace-compromised-account-recovery) and [signs your account is compromised](https://iblockspam.com/blog/signs-email-account-compromised) both tell you to check for unfamiliar POP and IMAP clients.

## How do admins turn off IMAP and POP3?

Admins should turn IMAP and POP3 off for everyone who doesn't need them. Both platforms let you do it centrally.

**Microsoft 365.** Microsoft says "support for Outlook on the web and MAPI, POP3, and IMAP4 email clients is enabled by default when a user mailbox is created." To change one mailbox, open the Exchange admin center, go to **Recipients** > **Mailboxes**, select the user, choose **Manage email apps settings**, and set **IMAP** and **POP3** to disabled. In Exchange Online PowerShell:

```powershell
# One mailbox
Set-CASMailbox -Identity "alex@yourcompany.example" -PopEnabled $false -ImapEnabled $false

# All existing mailboxes
Get-CASMailbox -ResultSize Unlimited | Set-CASMailbox -PopEnabled $false -ImapEnabled $false

# New mailboxes: change the defaults in every CAS mailbox plan
Get-CASMailboxPlan | Set-CASMailboxPlan -PopEnabled $false -ImapEnabled $false
```

[Set-CASMailboxPlan](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-casmailboxplan) documents that POP3 and IMAP4 are enabled by default in CAS mailbox plans, except that IMAP is off in the ExchangeOnlineDeskless plan.

**Google Workspace.** In the Admin console, go to **Menu** > **Apps** > **Google Workspace** > **Gmail** > **End User Access**, scroll to **POP and IMAP access**, and clear **Enable POP access for all users** and **Enable IMAP access for all users**. You can also keep IMAP but choose **Restrict which mail clients users can use (OAuth mail clients only)**. Google says changes "can take up to 24 hours" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/sync/turn-pop-and-imap-on-or-off-for-users), at the time of writing in November 2026).

When staff leave, turning these off is part of a clean handover; see [employee offboarding for email](https://iblockspam.com/blog/employee-offboarding-email-security).

## How do I switch from POP3 to IMAP without losing email?

Old POP3 setups often hold years of mail that exists only on one computer. Move it carefully:

1. **Back up first.** Export the mail app's data file, such as an Outlook PST file or the Thunderbird profile folder.
2. **Check what's on the server.** Sign in to webmail. If the server only holds recent mail, the rest lives only in your local data file.
3. **Add the account again as IMAP** (or as Exchange for Microsoft 365). Most apps can't convert an existing POP3 account.
4. **Copy old mail up.** Drag folders from the old POP3 account into the new IMAP account's folders so the server stores them. Check the mailbox quota first.
5. **Confirm, then remove the POP3 account.** Check on a second device or webmail that folders and sent mail appear, then delete the old POP3 account from the app.

If you're also changing email provider, follow the full [checklist for changing email hosting](https://iblockspam.com/blog/change-email-hosting-provider-checklist).

## Next steps

- Check which account type each of your devices uses, and move Microsoft 365 users to the Exchange account type.
- Turn off POP3 and IMAP for every user who doesn't need them, and for new mailboxes by default.
- Confirm your domain's MX, SPF, DKIM and DMARC are right for Microsoft 365 or Google Workspace with the [DNS Setup Checker](https://iblockspam.com/tools/email-dns-setup-checker).
- Remember that the protocol you read mail with doesn't change how mail is filtered: spam filtering happens before mail reaches your mailbox. If you want filtering in front of Microsoft 365 or Google Workspace, see [how iBlockSpam works](https://iblockspam.com/how-it-works).

Browse our other [email basics guides](https://iblockspam.com/blog/topic/basics).

## Frequently asked questions

### Should I use IMAP or POP3 for Outlook?

For a Microsoft 365 or Exchange mailbox, use neither: add it as an Exchange or Microsoft 365 account so mail, calendar and contacts sync. For other providers, choose IMAP so your folders stay in step across devices. Microsoft also says it has no plan to add OAuth sign-in for POP and IMAP in Outlook, which limits both protocols with Microsoft 365.

### Does POP3 delete emails from the server?

By default, usually yes. RFC 1939 says that with POP3, mail is normally downloaded and then deleted, and Microsoft notes POP3 clients remove downloaded messages by default. Most apps have a setting such as "Leave a copy of messages on the server". Turn it on before you connect a second device, or mail will appear on only one.

### Can I use IMAP and POP3 at the same time on one account?

You can, but it causes confusion. A POP3 client that deletes after downloading removes messages from the server, so they disappear from every IMAP device and from webmail. If you must mix them, set the POP3 client to leave messages on the server, or better, move every device to IMAP or Exchange.

### Which ports do IMAP and POP3 use?

IMAP uses port 993 with implicit TLS, or 143 for cleartext with STARTTLS. POP3 uses port 995 with implicit TLS, or 110 for cleartext. RFC 8314 recommends the implicit TLS ports, 993 and 995. Neither protocol sends mail; your app uses SMTP for that, normally on port 587 or 465.

### Why does my phone say Exchange when I add a work account?

Phone mail apps offer an Exchange account type that uses Exchange ActiveSync, a protocol for syncing a mobile device with an Exchange or Microsoft 365 mailbox. It syncs mail, calendar and contacts, and supports modern sign-in. Microsoft recommends Outlook for iOS and Android for Microsoft 365, and says built-in apps typically support modern sign-in if they're up to date.

## Sources

- [RFC 1939: Post Office Protocol - Version 3](https://www.rfc-editor.org/rfc/rfc1939.html)
- [RFC 9051: Internet Message Access Protocol (IMAP) - Version 4rev2](https://www.rfc-editor.org/rfc/rfc9051.html)
- [RFC 8314: Cleartext Considered Obsolete: Use of TLS for Email Submission and Access](https://www.rfc-editor.org/rfc/rfc8314.html)
- [Microsoft Learn: POP3 and IMAP4 in Exchange Online](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/pop3-and-imap4/pop3-and-imap4)
- [Microsoft Learn: Deprecation of Basic authentication in Exchange Online](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online)
- [Microsoft Learn: Managing email apps for user mailboxes](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/managing-email-apps-for-user-mailboxes)
- [Google Workspace Admin Help: Turn POP & IMAP on or off for users](https://knowledge.workspace.google.com/admin/sync/turn-pop-and-imap-on-or-off-for-users)
- [Google for Developers: IMAP, POP, and SMTP (Gmail)](https://developers.google.com/workspace/gmail/imap/imap-smtp)

## Free tools for this guide

- [Microsoft 365 & Google Workspace DNS Setup Checker](https://iblockspam.com/tools/email-dns-setup-checker): Check the MX, SPF, DKIM, DMARC and autodiscover records Microsoft 365 or Google Workspace asks for, against their admin docs.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.

---

Source: iBlockSpam, https://iblockspam.com/blog/imap-vs-pop3-vs-exchange (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt