Port 143 runs IMAP: messages stay on the server and are synced across all devices. Encryption starts only after connecting, via STARTTLS.
Per RFC 8314, port 993 with implicit TLS is preferred. If port 143 stays open, block plaintext logins with ssl = required and disable_plaintext_auth = yes (Dovecot).
Typical: a client set to "SSL/TLS" instead of "STARTTLS" connects to 143 – result is a timeout or TLS handshake error. Port and TLS mode must match.
Check
openssl s_client -starttls imap -connect mail.example.com:143