Does IMAP Delete Email From the Server? IMAP vs POP3

Yes, when you delete a message: IMAP deletes email from the server, and so from every app you connect. The server keeps the one real copy of your mail and each app works on it, so reading or downloading a message removes nothing, but deleting it in one app deletes it in all of them. Most apps first move it to a Trash folder, where you can still recover it, and Gmail usually archives it to All Mail instead. POP3 works differently: it downloads mail to one device and, depending on its settings, may delete the server’s copy. If you want alias mail from a domain you own in an app that can’t delete anything, CatchNone reads that mailbox read-only over IMAP or JMAP and never marks, moves, or deletes a message on the server, on iPhone, iPad, and Mac.

Does IMAP delete email from the server in every app?

Yes, though usually into Trash first rather than for good. The current IMAP (Internet Message Access Protocol) standard, RFC 9051, describes IMAP as a way to work with “remote message folders” as if they were local ones. IMAP apps do download messages: your phone, laptop, and webmail may each cache copies for speed and offline reading, but those copies follow the server. When a message leaves the server, it leaves every app at the next sync.

Deleting is two steps: flag, then expunge

1. The app sets the \Deleted flag on the message. It is marked for removal, but still there.
2. The EXPUNGE command, or closing the folder with CLOSE, permanently removes every flagged message in that folder.

Until the second step, clearing the flag brings the message back. Older desktop apps made this visible: Microsoft’s help for Outlook 2010 shows IMAP messages marked for deletion in strikethrough until they’re purged, after which “they are deleted from the IMAP mail server and cannot be restored.”

Delete usually means “move to Trash”

Most current apps move a deleted message to a Trash folder on the server instead. In IMAP terms that’s usually a MOVE: a copy, a \Deleted flag, and an expunge, done as one step. Every device sees the message in Trash, and it’s gone for good only when the Trash is emptied, by you, the app, or the provider. As of September 2026, Gmail permanently deletes messages in Trash after 30 days, and Apple’s iPhone Mail guide notes that iCloud doesn’t keep deleted messages longer than 30 days, whatever your iPhone is set to.

Gmail: labels, not folders

Gmail shows its labels to IMAP apps as folders, with system folders such as All Mail, Spam, and Trash under [Gmail]. Deleting from a label folder normally just removes that label. Google’s IMAP settings guide says: “You can find messages you delete from an IMAP folder in your ‘All Mail’ label in Gmail.” It also warns against pointing your app’s deleted messages at Gmail’s Trash, because they “will get permanently deleted from Gmail in 30 days.” Gmail’s own server-side delete settings are in the table below.

Does Outlook delete IMAP email from the server?

Yes. When Outlook is connected over IMAP, it works on the server copy like any other app, so a delete there reaches every device; some older versions show the message struck through first, as described above. If your mailbox is Outlook.com or Hotmail, its IMAP server is outlook.office365.com on port 993, and Microsoft requires modern sign-in (OAuth2). Since September 16, 2024, apps that send only a username and password no longer work with Outlook.com and Hotmail accounts.

Where deleted mail goes in common apps

Some choices skip the Trash: None on the Mac, Remove it immediately in Thunderbird, and Gmail’s delete-forever setting. Outside Gmail, so does Thunderbird’s Just mark it as deleted: the message stays flagged until the folder is expunged, then it’s gone. Thunderbird’s default is Trash; for Gmail accounts, Google recommends Just mark it as deleted with both “on Exit” boxes unchecked. The provider has the last word: Apple’s Mac guide says that if the server is set to delete older messages, they’re deleted “regardless of how you change this option.”

Does reading an email in another app mark it as read everywhere?

With IMAP, yes. Read status is the \Seen flag, stored on the server, so it syncs like a delete. An app that downloads a message by fetching BODY[] marks it read. One that fetches BODY.PEEK[] leaves it as it was, and can set \Seen itself when you open the message.

JMAP, the newer protocol covered below, syncs read status the same way. POP3 has no read status at all, so each device keeps its own. The exception is Gmail, whose POP settings can mark Gmail’s copy as read when another app downloads it.

IMAP vs POP3: which keeps your mail on the server?

IMAP keeps it on the server by design. POP3 (Post Office Protocol version 3, usually just called POP; RFC 1939) was built for the opposite job: “normally, mail is downloaded and then deleted.”

POP deletes in two steps as well. The DELE command only marks a message, and the server removes it when the app ends the session with QUIT. “Leave messages on server” is an app setting. The standard calls it a “weak version” of what IMAP does, and a server may not honor it. What happens to the server copy depends on the app and the provider:

• Thunderbird: new POP accounts set up with Thunderbird’s account wizard leave mail on the server for at most 14 days by default, and deleting a message locally deletes the server copy too.
• Gmail: the POP settings offer Keep Gmail’s copy in the Inbox, Mark Gmail’s copy as read, Archive Gmail’s copy, or Delete Gmail’s copy.
• Yahoo: its POP access “downloads copies of your email, so you can move and delete them in the app without affecting the original emails.”

Use IMAP unless you have a specific reason not to. POP fits when you want one computer to hold the only copy, for example to pull down an old account’s mail before closing it, and that computer is backed up.

Not sure which one your app uses? Check the account’s server settings: port 993 or 143 means IMAP, and 995 or 110 means POP. Exchange and Microsoft Graph are Microsoft’s own protocols, separate from both.

Which providers offer IMAP or POP3

Server names and ports, as of September 2026:

What read-only IMAP access means

Read-only IMAP access means the app opens a folder with EXAMINE instead of SELECT, and downloads messages with BODY.PEEK[] instead of BODY[]. Nothing in the mailbox changes: no message is marked read, flagged, moved, or deleted. A read-only email client is any app that sticks to those commands.

You can see the difference in the server’s reply. These two exchanges are the examples from RFC 9051 (C: is the app, S: the server, and blurdybloop is the standard’s sample folder name):

C: A142 SELECT INBOX
S: * 172 EXISTS
S: * OK [UIDVALIDITY 3857529045] UIDs valid
S: * OK [UIDNEXT 4392] Predicted next UID
S: * FLAGS (\Answered \Flagged \Deleted \Seen \Draft)
S: * OK [PERMANENTFLAGS (\Deleted \Seen \*)] Limited
S: * LIST () "/" INBOX
S: A142 OK [READ-WRITE] SELECT completed

C: A932 EXAMINE blurdybloop
S: * 17 EXISTS
S: * OK [UIDVALIDITY 3857529045] UIDs valid
S: * OK [UIDNEXT 4392] Predicted next UID
S: * LIST () "/" blurdybloop
S: * FLAGS (\Answered \Flagged \Deleted \Seen \Draft)
S: * OK [PERMANENTFLAGS ()] No permanent flags permitted
S: A932 OK [READ-ONLY] EXAMINE completed

The last line of each reply says how the folder is open: [READ-WRITE] or [READ-ONLY]. PERMANENTFLAGS lists the flags the app may change for good: in these examples, \Deleted, \Seen, and new keywords (\*) after SELECT, and none after EXAMINE. In an examined folder, the standard permits “no changes to the permanent state of the mailbox, including per-user state,” and closing it expunges nothing.

Does the server enforce read-only?

Over IMAP, and for your own mailbox, only when the app asks for it. After EXAMINE, the server holds that folder read-only for the session. Everything else stays in the app’s hands:

• The same login can send SELECT instead, at any time.
• EXAMINE covers one folder. Account-level commands such as DELETE (a whole folder), RENAME, and APPEND still work.
• BODY.PEEK[] is purely the app’s choice.

A server can also impose read-only through access rights (RFC 4314), but that’s used for shared and delegated mailboxes. Gmail, Outlook.com, iCloud, and Fastmail document no read-only IMAP login to your own mailbox; the closest thing is Fastmail’s read-only JMAP token, below.

What your password or sign-in allows

Fastmail lets you limit an app password by type of data, but documents no read-only option. Google’s read-only permission exists only for its own Gmail API, not for IMAP. So when an app says it’s read-only, you’re trusting the app, not the password.

How to test a new mail app safely

1. Choose IMAP (or JMAP), not POP. A POP app may take mail off the server as it downloads it. An IMAP app leaves mail where it is, though deletes still sync (step 4).
2. Use a read-only token if your provider and app support one. This works only with apps that connect over JMAP. At Fastmail, go to Settings → Privacy & Security → Connected apps & API tokens → Manage API tokens → New API token, choose JMAP, and select Read-only access and Email and nothing else (Fastmail’s API token guide). Our Fastmail guide walks through creating the token. API tokens aren’t available on Fastmail’s Basic plan, as of September 2026.
3. Otherwise, give it its own app password. Then you can revoke that one password later without touching your other apps. For iCloud, create one at account.apple.com → Sign-In & Security → App-Specific Passwords; our iCloud app-specific password guide walks through it. For Gmail you need 2-Step Verification, and Google prefers Sign in with Google where the app offers it; see Gmail app passwords and IMAP settings.
4. Right after adding the account, before you delete anything, check its delete setting. Use the table above: pick Trash or Archive (for Gmail, follow Google’s advice above rather than Trash), and avoid None, Remove it immediately, and, outside Gmail, Just mark it as deleted until you trust the app.
5. Test with a message you don’t need. Send yourself one, open it in the new app, and see whether it turns read in your usual app. Then delete it in the new app and see where it lands.
6. Revoke the password when you stop using the app. Apple’s app-specific password page explains Remove and Revoke All. Google’s are managed at myaccount.google.com/apppasswords, as its app passwords help page explains.

JMAP vs IMAP in brief

JMAP (JSON Meta Application Protocol) is a newer email protocol for the same job, published in 2019 as RFC 8620 and RFC 8621, with a Fastmail engineer as lead author. It sends JSON over HTTPS instead of IMAP’s text commands, and every request must use TLS 1.2 or later. The IETF’s introduction calls IMAP “resource hungry” and a poor fit for mobile networks.

For deletion and read status, the model is familiar:

• An email can be in several mailboxes at once, much like Gmail labels.
• Deleting usually means moving it to the mailbox with the trash role. “Destroying” it removes it from every mailbox.
• Read status is the $seen keyword, JMAP’s version of \Seen.
• The server tells each app whether the whole account is read-only.

Does it matter to you? Only if your provider offers JMAP and your app supports it. Fastmail offers it on plans above Basic. Among apps, Thunderbird desktop doesn’t support it yet, though its September 2, 2026 announcement says the team is optimistic about adding it later. Either way, deletes sync just as they do in IMAP.

Is IMAP on port 993 secure? What is STARTTLS?

Yes, in transit. On port 993, IMAP is encrypted from the first byte: the connection opens with a TLS handshake, the same kind of protection HTTPS gives a website. This is called implicit TLS. Port 143 is IMAP’s cleartext port, where an app can upgrade the connection with the STARTTLS command.

The standards now prefer port 993. RFC 8314 (2018) recommends implicit TLS over STARTTLS for mail apps, with TLS 1.2 or later, and RFC 9051 requires every server built to the current standard to offer implicit TLS. A 2021 USENIX Security study found over 40 STARTTLS flaws in mail clients and servers, and about 320,000 servers (2%) open to command injection. Many were fixed after disclosure, but the authors concluded that STARTTLS “should be avoided.” Fastmail doesn’t offer it for IMAP or POP, and Gmail and iCloud require an encrypted connection (SSL/TLS) on port 993.

TLS protects the connection, not the stored message, and it isn’t end-to-end encryption; RFC 8314 says so itself. So port 993 protects your password and mail on the way, and nothing more. The weak points are your password (use two-factor sign-in and app passwords) and what each app does with the access you give it.

A read-only client for your aliases: CatchNone

CatchNone is a read-only client in exactly the sense above, built for email aliases on a domain you own. Over IMAP (implicit TLS, port 993 by default) it opens only your inbox with EXAMINE and downloads with BODY.PEEK[]; over JMAP it uses an access token. It never marks, moves, or deletes anything on your server, so none of the deletes in this article can start from it. It reads your mailbox directly from your device, and that mail never passes through CatchNone’s servers.

Each shop, newsletter, or account gets its own alias, and each message is badged with the alias it reached, so a leaked or sold address shows up. CatchNone is receive-only by design: signup mail stays in its own app, apart from your main inbox. The Free plan covers up to 10 aliases on your own domain, and Lite and Premium have no limit. If you’d rather skip the domain and mailbox, Premium adds @catchnone.com addresses with nothing to set up.

The password or app password you enter still has full access: read-only is how the app behaves, not what the credential allows. There’s no POP3, Exchange, STARTTLS, or OAuth sign-in, so Outlook.com and Hotmail likely can’t be connected, and Gmail needs an app password. Your domain’s mail has to reach that inbox first, usually through a catch-all address at an email host that supports catch-all; mail filed as spam or moved by a rule doesn’t appear. Download CatchNone for iPhone, iPad, and Mac.

FAQ

What does “delete from server” mean?

Your provider’s server holds the master copy of your mail; your apps hold copies. With IMAP, every delete is a server delete, usually by way of Trash. With POP, it’s a setting: the app either leaves the server copy after downloading or removes it.

I deleted an email by mistake. Can I get it back?

Usually, if you’re quick. Look in the Trash (or Deleted) folder on the server, through webmail or any app; for Gmail, also check All Mail. Gmail and iCloud keep Trash for at most 30 days, as of September 2026. Once the Trash is emptied or the message is expunged, it’s gone from every app.

Can I delete email on my phone but keep it on the server?

Not with an IMAP delete, which removes it everywhere. Archive instead: on iPhone, select Archive Mailbox under Move Discarded Messages Into, and messages you discard go to your archive mailbox rather than Trash. With POP and “leave messages on server,” a local delete leaves the server copy alone unless the app is also set to delete it there, as new POP accounts in current Thunderbird are (Until I delete them). The server may still remove old mail under its own policy.

Can I delete email from the server but keep a copy on my computer?

Yes: first move it to a mailbox stored on the computer. In Mail on Mac, choose Mailbox → New Mailbox and set Location to On My Mac; Apple says those mailboxes are local to that Mac. Thunderbird’s Local Folders work the same way. After you delete the server copy, that computer holds the only one, so back it up.

Will removing an account from an app delete my email?

Not for IMAP. Apple’s Mail guide for Mac says the account’s messages are removed from your Mac, while “copies of messages remain on the account’s mail server.” With POP, back up first: removing the account deletes the downloaded messages from your Mac, and only what the server still holds survives.