IMAP & SMTP Settings Explained: Ports 993, 465, 587 and 25

Incoming vs outgoing: two different jobs

Email clients talk to two separate services. The incoming server (IMAP, or the older POP3) lets your app read the mail stored in your mailbox. The outgoing server (SMTP) accepts the messages you write and passes them on to the recipient’s provider.

They are configured separately because they are separate protocols with separate ports. It is common for incoming mail to work perfectly while sending fails, or the other way round — which is a useful clue when troubleshooting. Many providers, including HavitoMail, use the same hostname for both, but you still enter it twice.

IMAP ports: 993 and 143

IMAP is the protocol that keeps your mail on the server and syncs read status, folders and deletions across every device. It runs on two ports:

• Port 993 — IMAP over SSL/TLS (“implicit TLS”). The connection is encrypted from the very first byte. This is the recommended choice in almost every client.
• Port 143 — plain IMAP that is upgraded to encryption with the STARTTLS command. Fine when STARTTLS is enforced, but if a client is set to “None” it could send your password unencrypted. Prefer 993.
• POP3 uses 995 (SSL) and 110 (STARTTLS). Only use POP3 if you deliberately want mail downloaded to a single device — see our IMAP vs POP3 guide.

SMTP ports: 465, 587 and 25

Outgoing mail has three common ports, and the difference between them confuses almost everyone:

• Port 465 — SMTP submission over implicit TLS (SSL). Encrypted from the start, like IMAP on 993. Once marked deprecated, it was formally re-standardised for mail submission in RFC 8314 and is the simplest reliable option today.
• Port 587 — SMTP submission with STARTTLS. The client connects in plain text, then upgrades to encryption before logging in. Widely supported and a good fallback if 465 is blocked on a network.
• Port 25 — server-to-server relay. This is how mail servers deliver to each other across the internet. It is not meant for your laptop or phone, and most home ISPs, mobile networks and cloud hosts block outbound port 25 to stop spam from infected machines.

SSL vs TLS vs STARTTLS — what to pick in the menu

Clients label the encryption options inconsistently. “SSL”, “SSL/TLS” and “TLS” in a dropdown usually mean implicit TLS (ports 993 and 465). “STARTTLS” means the upgrade-in-place method (ports 143 and 587). SSL itself is obsolete; modern servers actually use TLS 1.2 or 1.3 regardless of what the label says.

The rule that avoids 90% of errors: the encryption setting must match the port. SSL/TLS with 465, STARTTLS with 587. Mixing them (STARTTLS on 465, or SSL on 587) produces timeouts or “connection closed unexpectedly” errors.

Username, password and authentication

For business email the username is almost always your full email address — priya@yourcompany.com, not just “priya”. The password is your mailbox password.

Outgoing mail must also authenticate. Look for a checkbox such as “My outgoing server requires authentication” or “Use same settings as incoming server” and make sure it is enabled. Without it, the server refuses to relay your message and you get a “relay access denied” or “authentication required” error. Authentication method should be “Normal password” or “Password” — the connection is already encrypted by TLS.

HavitoMail settings at a glance

• Incoming (IMAP): mail.havitomail.com, port 993, SSL/TLS.
• Outgoing (SMTP): mail.havitomail.com, port 465 with SSL/TLS — or port 587 with STARTTLS.
• Username: your full email address (e.g. you@yourcompany.com) for both incoming and outgoing.
• Password: your mailbox password; outgoing authentication turned on.
• Use mail.havitomail.com as the server name even though your address is on your own domain — that is the name on the server’s TLS certificate.

Common errors and what they mean

• Authentication failed — wrong password, or the username is not the full email address. Re-type both; watch for autofill adding a space.
• Cannot verify server identity / certificate mismatch — you entered mail.yourcompany.com instead of the provider’s hostname. Use the hostname your provider gives you.
• Connection timed out on send — the port is blocked by your network or the encryption type does not match the port. Try 587 with STARTTLS instead of 465, or vice versa.
• Relay access denied — SMTP authentication is switched off in the client.
• Receiving works but nothing arrives from outside — usually DNS, not your client. Check your MX records with a DNS checker.
• Sent mail lands in spam — a deliverability problem: confirm SPF, DKIM and DMARC are in place for your domain.