3

Hotmail appears to have two separate IMAP ports:

imap-mail.outlook.com 993

And:

imap-mail.outlook.com 143

My guess here is that 143 is unsecured, and 993 is over SSL. However, when I try to connect over 993:

telnet imap-mail.outlook.com 993

I just get a blank screen - no acknowledgement or greeting message. When I try the same thing over 143, I do get a message, but it's encrypted:

ImapLogin

Subsequently, issuing login commands fail:

. LOGIN myaddress@hotmail.co.uk mypassword

With:

. BAD Command received in Invalid state.

I can't even enter this on 993 as I don't get the greeting.

Please could someone advise me as to why this is not correctly connection, and possibly advise as to how to remedy the problem?

closed as off-topic by Gerald Schneider, user259412, Ward, gf_, Jenny D Aug 19 '17 at 12:39

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on Server Fault must be about managing information technology systems in a business environment. Home and end-user computing questions may be asked on Super User, and questions about development, testing and development tools may be asked on Stack Overflow." – Gerald Schneider, Ward, gf_, Jenny D
If this question can be reworded to fit the rules in the help center, please edit the question.

  • You should go read the RFCs specifying the IMAP standard; they will tell you how the protocol should be used. – Jenny D Aug 19 '17 at 12:40
8

This is normal; it's exactly the same that happens, if you try to telnet HTTPS 443; the port 993 is for IMAPS, which uses TLS. In TLS connection (from RFC 5246, 7.4.1.2 Client Hello):

When a client first connects to a server, it is required to send the ClientHello as its first message. The client can also send a ClientHello in response to a HelloRequest or on its own initiative in order to renegotiate the security parameters in an existing connection.

The server doesn't greet you because you are supposed to greet it first!

The IMAP port 143 works differently, because it doesn't start the connection with TLS. The connection starts as plain text, and the client request for TLS with (RFC 3501, 6.2.1) STARTTLS:

A [TLS] negotiation begins immediately after the CRLF at the end of the tagged OK response from the server. Once a client issues a STARTTLS command, it MUST NOT issue further commands until a server response is seen and the [TLS] negotiation is complete.

Example:

C: a001 CAPABILITY
S: * CAPABILITY IMAP4rev1 STARTTLS LOGINDISABLED
S: a001 OK CAPABILITY completed
C: a002 STARTTLS
S: a002 OK Begin TLS negotiation now
<TLS negotiation, further commands are under [TLS] layer>
C: a003 CAPABILITY
S: * CAPABILITY IMAP4rev1 AUTH=PLAIN
S: a003 OK CAPABILITY completed
C: a004 LOGIN joe password
S: a004 OK LOGIN completed

In other words, both CAN be secure, but 143 isn't necessarily as it's also used for plain IMAP.


If you need to debug connection over TLS, you cannot use the telnet command, originally designed for the telnet protocol, for that. However, there are several other tools, e.g.

  • OpenSSL

    openssl s_client -connect imap-mail.outlook.com:993
    openssl s_client -starttls imap -connect imap-mail.outlook.com:143
    
  • GnuTLS

    gnutls-cli imap-mail.outlook.com -p 993
    gnutls-cli imap-mail.outlook.com -s -p 143
    
  • ncat and socat (no support for STARTTLS)

    ncat --ssl imap-mail.outlook.com 993
    socat openssl:imap-mail.outlook.com:993 stdio
    socat ssl:imap-mail.outlool.com:993 readline
    
  • On Debian, telnet-ssl -z ssl imap-mail.outlook.com 993

  • Thanks for this! I think you've put me on the right track here - however, when I said the server doesn't acknowledge or greet me, it also doesn't allow text entry. Similarly, when I issue STARTTLS on 143, it tells me it's starting negotiations, but then loses connection. Presumably I am, for some reason, unable to establish a secure connection? – Paul Michaels Aug 19 '17 at 7:22
  • You are, but your email client can. You are just not capable of writing TLS encrypted traffic on your keyboard. Only Akira Shirase a.k.a. BPS has such skills. – Esa Jokinen Aug 19 '17 at 7:44
  • Okay - but to be clear, you're saying that communication over IMAP using telnet is not possible with Hotmail, due to encryption? – Paul Michaels Aug 19 '17 at 8:33
  • It requires, among other things, calculations that are not very practical to make on paper. Encryption is designed to be programmed. – Esa Jokinen Aug 19 '17 at 9:01
  • Sorry, I understand what encryption is, I suppose what I was asking was more relating to telnet - can it not be given an ssl certificate ? – Paul Michaels Aug 19 '17 at 10:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.