We've recently moved to a semi-outsourced Exchange farm, replacing our internal one. An application I've been asked to help troubleshoot uses IMAP to download some emails from the Exchange servers in question. This fails. Attempting to "speak the protocol" directly (e.g., with CAPABILITY) produces custom messages about only STARTTLS being allowed (I know they are custom to some degree because they mention the internal name of the project to "semi outsource" our email.) Is this within the spec for IMAP? My reading of the RFCs is that the CAPABILITY command should always be available, even if not always believable. (NOOP and LOGOUT also do not work at this point.) Is this a configuration concern with Exchange or is it possibly somewhere else? (IDS/Firewall?)
For what it is worth, I also got permission to nmap the test Exchange instance, and it does not find IMAP on port 143 but instead thinks it is some other protocol, which is suggestive. (It thinks it is BIND but the proceeds to crash on the BIND version checks, which isn't surprising given the strings that it would be getting.)
Edit: 993 might already be expecting a TLS/SSL connection from a tunnel set up some other way. Does this make sense?