Modified UTF-7 was designed to fix five problems with standard UTF-7: '+' shift character conflicts with mailbox name usage; '/' in BASE64 conflicts with hierarchy delimiter; prohibited '\' and '~' conflict with hierarchy delimiters and home directory indicators; and UTF-7 allows multiple encodings of the same string.

email

UIDs are designed to persist across sessions to support disconnected and offline clients that need to resynchronize state from a previous session. The UIDVALIDITY mechanism is an acknowledged fallback for server environments where persistence is unavoidable (e.g., after mailbox deletion/recreation or non-IMAP reordering of the message store).

email

IMAP4rev1 is designed to be upward-compatible with IMAP2 and IMAP2bis. It is largely compatible with RFC 1730 IMAP4, except for certain facilities added in RFC 1730 that were subsequently removed. Obsolete commands, responses, and data formats that may be encountered with older implementations are described in [IMAP-OBSOLETE].

email

A new mailbox created with the same name as a deleted mailbox MUST have UIDs greater than any UIDs used in the previous incarnation, unless the new incarnation has a different UIDVALIDITY value. The highest-used UID of a deleted mailbox MUST be preserved.

email

A server MUST implement a configuration that does NOT permit any plaintext password mechanisms unless STARTTLS has been negotiated or equivalent protection is provided. A client MUST NOT send a LOGIN command if the LOGINDISABLED capability is advertised.

email, security

A server MUST send mailbox size updates automatically whenever a mailbox size change is observed during command processing. It is NOT permitted to send an EXISTS response that reduces the message count; only the EXPUNGE response may do this.

email

After issuing STARTTLS, the client MUST discard cached server capabilities and SHOULD re-issue the CAPABILITY command. This is necessary to protect against man-in-the-middle attacks that alter the capabilities list prior to STARTTLS negotiation.

email, tls, security

Before returning OK to SELECT, the server MUST send untagged FLAGS, EXISTS, and RECENT responses, plus OK responses containing UNSEEN, PERMANENTFLAGS, UIDNEXT, and UIDVALIDITY codes. The tagged OK MUST be prefixed with [READ-ONLY] if the client cannot modify the mailbox.

email

Binary strings (those containing NUL characters) MUST be encoded into a textual form such as BASE64 before transmission. Unencoded binary strings are not permitted in IMAP4rev1.

email

Client and server implementations MUST implement the STARTTLS, LOGINDISABLED, and AUTH=PLAIN capabilities. The server MUST send a single untagged CAPABILITY response including 'IMAP4rev1' before the tagged OK response to the CAPABILITY command.

email, tls, security

Clients MUST NOT send multiple commands without waiting if an ambiguity would result. If the client sends any command other than FETCH, STORE, or SEARCH, it MUST wait for the completion response before sending a command that uses message sequence numbers, because EXPUNGE responses can invalidate sequence numbers.

email

If a server has an inactivity autologout timer, its duration MUST be at least 30 minutes. Receipt of ANY command from the client during that interval SHOULD suffice to reset the timer.

email

Mailbox names are 7-bit. Clients MUST NOT attempt to create 8-bit mailbox names; the name INBOX is case-insensitive and reserved as the primary mailbox for the user. Servers SHOULD prohibit creation of 8-bit mailbox names.

email

The DELETE command MUST NOT remove inferior hierarchical names. Deleting a mailbox that has inferiors and lacks \Noselect removes its messages and assigns it \Noselect. Attempting to delete a mailbox that has inferiors and already has \Noselect is an error.

email

The UID of a message MUST NOT change during the session and SHOULD NOT change between sessions. Any change of UIDs between sessions MUST be detectable using the UIDVALIDITY mechanism. Persistent UIDs are required to support disconnected/offline client resynchronization.

email

When a mailbox is renamed, all inferior hierarchical names MUST also be renamed. Renaming INBOX is a special case: all messages are moved to the new mailbox name, leaving INBOX empty; inferior hierarchical names of INBOX are unaffected.

email

When the client requests logout, the server MUST send an untagged BYE response before the tagged OK, then close the connection. A server MUST NOT unilaterally close the connection without first sending an untagged BYE that contains the reason.

email

Each client command is prefixed with a unique tag string (e.g., 'A0001'). Server completion responses carry the matching tag, enabling response correlation when multiple commands are in progress. Untagged server data is prefixed with '*' and command continuation requests with '+'.

email

IMAP4rev1 servers listen on TCP port 143. The protocol requires a reliable data stream; all interactions are line-oriented (CRLF-terminated) or consist of a known-length octet sequence followed by a line.

email, tcp

International mailbox names use modified UTF-7: printable US-ASCII characters except '&' represent themselves, '&' is encoded as '&-', and other characters are encoded in modified BASE64 using ',' instead of '/'. All names must start and end in US-ASCII.

email

Message sequence numbers are relative positions from 1 to the number of messages in the mailbox, ordered by ascending UID. Unlike UIDs, sequence numbers can be reassigned during a session; they are decremented for all subsequent messages when a message is expunged.

email

System flags are predefined message flags beginning with '\': \Seen, \Answered, \Flagged, \Deleted, \Draft, and \Recent. \Recent is a session-only flag set for messages newly arrived in the first session to be notified; it cannot be altered by the client.

email

The AUTHENTICATE command initiates a SASL authentication exchange. Server challenges are command continuation requests ('+') followed by BASE64-encoded data; client responses are single lines of BASE64. The client may cancel by sending a single '*', which MUST cause the server to reject with BAD.

email, security

UIDVALIDITY is a 32-bit value sent in a UIDVALIDITY response code at mailbox selection time. If UIDs from an earlier session fail to persist in the current session, UIDVALIDITY MUST be greater than the value used in the earlier session, so clients can detect UID reuse.

email

Unique Identifier (UID) is a 32-bit value assigned to each message. Combined with UIDVALIDITY, it forms a 64-bit identifier that MUST NOT refer to any other message in the mailbox or any subsequent mailbox with the same name forever. UIDs are assigned in strictly ascending order.

email

A server MUST implement a configuration rejecting all plaintext password mechanisms unless STARTTLS or other session protection is active. Servers SHOULD additionally implement non-plaintext SASL mechanisms such as GSSAPI or DIGEST-MD5 to reduce reliance on transport-layer security alone.

email, security

The LOGIN command transmits plaintext passwords and SHOULD NOT be used over insecure networks. A server MUST implement a configuration that advertises LOGINDISABLED and disallows LOGIN unless STARTTLS or equivalent session protection is active. Client implementations MUST NOT send LOGIN if LOGINDISABLED is advertised.

email, security

IMAP4rev1 connections exist in one of four states: Not Authenticated (initial; credentials required before most commands), Authenticated (mailbox selection required), Selected (a mailbox is open), and Logout (connection terminating). State transitions are triggered by successful LOGIN/AUTHENTICATE, SELECT/EXAMINE, CLOSE, LOGOUT, or connection events.

email

A literal string is encoded as '{N}CRLF' followed by N octets of data. Clients transmitting literals to the server MUST wait for a command continuation request ('+' token) before sending the octet data, even when the octet count is 0.

email