IMAP check

What it verifies

An IMAP monitor connects to the host and port from each of its regions, and the check passes when the first line of the greeting starts with * OK. On port 993, the probe first completes a TLS handshake against the public root store with the host as SNI, and every other port is read in plaintext. With the certificate sub-check on, the monitor also judges expiry, issuer, and subject, over the direct handshake on 993 or over STARTTLS on the other ports.

Use it when

• A mail server has an IMAP endpoint that clients read from, and a refused connection or a missing greeting should open an incident.
• The certificate the server presents should be judged with the service, without a second monitor. The sub-check covers expiry, issuer, and subject over implicit TLS or STARTTLS.
• The IMAPS endpoint must stay publicly trusted. On 993 the greeting is read only after a handshake against the public root store, so a chain problem shows up as an outage.

The check does not log in, open a mailbox, or send CAPABILITY. Use the SMTP check for an SMTP endpoint, and the TLS certificate check for a certificate on a direct TLS port that deserves its own incident. A self-signed IMAPS server on 993 fails the greeting probe, because allow_self_signed reaches only the certificate sub-check.

Swipe sideways to inspect the product view.

app.perstat.io

Configuration

Target. A host name or IP address without scheme or path, plus an optional port. The form suggests 993. Every resolved address is validated before the probe connects. Loopback, private, link-local, and cloud metadata addresses are refused, so the monitor cannot reach an internal network.

TLS certificate

A passing greeting can be followed by a certificate policy, once per check rather than per address. On 993 it uses a direct handshake, and on every other port the IMAP STARTTLS dialog (A1 STARTTLS, then A1 OK). The form offers the switch with port, warning window, issuer and subject regex, and the self-signed toggle. Without the switch, the monitor view still shows the served certificate, but the policy and the expiry advisory need the switch.

How a check runs

1. Each region due for the interval resolves the host through the node’s own resolver.
2. Every resolved address of the chosen family is validated against the blocked ranges, then connected on its own.
3. On port 993, the probe first completes a TLS handshake against the public root store, with the host as SNI. On every other port it stays in plaintext. Then it reads the first line the server sends.
4. A line starting with * OK passes, and anything else fails. Connection, handshake, and greeting share the 10 s limit. A server that stays silent is down, not a configuration error.
5. Only a passing check with tls_cert.enabled runs the certificate policy, once per check. It uses a direct handshake on 993 and the STARTTLS dialog on other ports. The regexes are compiled first, and an invalid one ends the check as an error.
6. The region’s result goes to the control plane. A failure opens an incident once the alert policy’s quorum agrees, by default 2 regions over 2 consecutive checks.

Swipe sideways to inspect the product view.

app.perstat.io

What a result contains

Greeting

The first line the server sent, judged for * OK.

Response time

Time to the greeting, on 993 including the TLS handshake, per region and per address.

Detail line

One line that says what happened: the greeting, IMAP error: with the transport or handshake error, or Timeout. With the sub-check on, the certificate finding is appended to the greeting on a pass and replaces it on a failure.

Cause layer

Whether the failure sat with the target’s DNS (NXDOMAIN or NODATA) or with its application after a successful lookup. Anything else is reported as unknown.

Certificate

The result keeps the common name, alternative names, and issuer, plus the validity dates, the self-signed flag, and public trust. Every check reads them, with or without the sub-check. The remaining lifetime with its warning appears only with the sub-check on.

Region, family, address

Every result carries the region that measured it, and one sub-result per IP family and per address.

States and severity

• okThe greeting starts with * OK, on 993 after a trusted handshake. With the sub-check on, the certificate policy also holds, and a certificate inside its warning window keeps this state.
• degradedOne IP family fails while the other answers, or some of several resolved addresses of a family fail while the others answer. This applies at the default family_fail_severity.
• downThe connection is refused, times out, or is blocked, or the greeting is not * OK. The check is also down when the handshake on 993 is rejected for an untrusted chain, a hostname mismatch, or an expired certificate. The same applies when the certificate policy fails on expiry, a rejected handshake, or an issuer or subject mismatch.
• errorThe configuration cannot run, for example because of an invalid regex in the certificate policy. The check ends as an error instead of a failure and counts as an outage with severity critical.

Confirmed by quorum: by default, 2 regions must report the failure before an incident opens. The organization default asks for 2 regions and 2 consecutive checks. A monitor can carry its own rule with count or percent, consecutive checks, and a minimum duration.

Plans and limits

Shortest interval

300 s on Free, 60 s on Pulse, 30 s on Sentinel, 15 s on Command, and 10 s on Enterprise. The web form offers 30 s, 1 min, 5 min, 15 min, and 1 h. The 15 s and 10 s floors are reachable only through MCP.

Regions

2 of 6 on Free, 3 of 6 on Pulse, and all 6 from Sentinel.

Monitors

10 on Free, 50 on Pulse, 150 on Sentinel, 500 on Command, and a custom quota on Enterprise. The eleven probe check types share this quota. Host agents and heartbeats have their own quotas.

Compare every plan limit

From the pipeline or an agent

The same config works in the deploy step, in an MCP client such as Claude Code, and in the form above. create_monitor needs an organization-wide API key. If you omit regions, the plan picks its default.

{
  "name": "Mailbox IMAPS",
  "type": "imap",
  "interval_seconds": 60,
  "config": {
    "host": "mail.example.com",
    "port": 993,
    "tls_cert": { "enabled": true, "warn_days": 21 }
  }
}

Every interface, with its boundary

Limits

• No login, no mailbox access, and no CAPABILITY. The probe reads one line.
• On 993, the greeting probe demands a publicly trusted chain. The allow_self_signed switch reaches only the certificate sub-check, so a self-signed IMAPS server stays down.
• Only port 993 means implicit TLS. Every other port is read in plaintext, and the certificate sub-check uses STARTTLS there.
• The certificate policy runs once per check, not per address, and only after a passing greeting.
• Targets on private, loopback, link-local, and cloud metadata addresses are refused.
• Not every region probes IPv6, so selecting ipv6 restricts the usable regions.
• SPF, DMARC, and CAA of the mail domain belong to the DNS hygiene check.

Related check types

• SMTP checkBanner and EHLO of a mail server, with an optional certificate check over STARTTLS or implicit TLS.
• TLS certificate checkExpiry, issuer, and subject of a certificate by direct TLS handshake, with an advisory ahead of expiry.
• TCP port checkWhether a port accepts a connection, optionally with the certificate served on it.
• DNS hygiene checkSPF, DMARC with its policy, and CAA of a domain, graded as posture and never as an outage.

All check types