Port 993 is IMAP over implicit TLS: encrypted from the first byte and, per RFC 8314, the recommended option. Thunderbird, Outlook, Apple Mail and phones use it by default with the "SSL/TLS" setting.
Open it inbound on a mail server. Against password guessing, use Fail2ban on the Dovecot logs plus strong passwords or app passwords.
Common errors: certificate warnings because the client connects to mail.example.com while the certificate only covers another name; AUTHENTICATIONFAILED from a wrong username (full address vs. local part).
Check
openssl s_client -connect mail.example.com:993 -servername mail.example.com