Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I work for a small company (around 40 people) and our email is available via IMAP - but only when connected to our VPN. For iPhone users (and generally), the VPN connection appears to be an unnecessary overhead - after all, the IMAP traffic is encrypted and password-protected, so should I have any hesitations about opening up the IMAP SSL traffic to the internet?

(I can imagine greater concern for SMTP traffic perhaps - though, again, if encrypted and password protected, am I being overcautious?)

share|improve this question
up vote 3 down vote accepted

It depends how much you want to open yourself up to potential vulnerabilities.

Using the VPN gives you an extra layer of protection, however it requires additional work to configure devices. Personally I'm happy to allow IMAPS from the internet, provided there's a good password policy in place.

Keeping the VPN is an option, and if you require the very highest level of security, then keep it. Otherwise I don't see why you shouldn't open it up.

At least you're erring on the side of caution - always a good trait!

share|improve this answer
Personally I can't conceive of an email service for a company that isn't accessible from the outside: if not over IMAP(S) then through webmail or something. I'd prefer IMAP+SSL to webmail any day for security and convenience sake – voretaq7 Feb 5 '10 at 19:30

As long as your IMAP server is patched, you are only (ahem) vulnerable to zero-day attacks. So if the traffic is encrypted then you should be OK.


I can see that forcing users to connect to the VPN first takes away the attack vector opened up by allowing anyone on the Internet to connect to your IMAP server. So, I doubt anyone would get fired for insisting on this. It's a good belt-and-braces approach.

It's the old security vs. convenience thing...if all this is for is because you feel that the VPN is unnecessary overhead on your iPhone's 3G connection, it might not fly. Get an influential member of your Business Development team to complain however, and you might be in business! :)

share|improve this answer
The question is prompted by our MD so I guess I have the influential stimulus! Thanks. – Peter Howe Feb 5 '10 at 16:44

I think you'd be reasonably safe in using opening up IMAP access to the outside without VPN access as long as...

1) You requre/enforce SSL connections to encrypt IMAP traffic going back and forth.

2) You have some reasonable way to prevent DOS and brute force attacks.


3) You have some end-to-end email security solution to protect confidential info.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.