Port 585: IMAP4-SSL (Deprecated) — The ghost port that email clients won't forget

Port 585 is a de-registered port — it was officially removed from service by IANA on April 25, 2006. It once carried IMAP4-SSL (IMAP over SSL), but that role was consolidated to port 993 (IMAPS). IANA's registry explicitly states: "Use of 585 is not recommended, use 993 instead."¹

Despite being dead for nearly two decades, port 585 continues to cause problems because some email clients — particularly Apple Mail — still probe it when auto-detecting server settings.

What Port 585 Was Used For

Port 585 was one of several ports historically associated with IMAP4-SSL, an early attempt to run IMAP (Internet Message Access Protocol) over SSL/TLS encryption. The idea was simple: take the standard IMAP protocol and wrap it in encryption for secure email access.

But the implementation was messy. Multiple ports were used unofficially for encrypted IMAP, creating confusion about which port to use. The Internet standardized on port 993 for IMAPS (IMAP over SSL/TLS), and port 585 was deprecated.²

Why Port 585 Still Causes Problems

Even though IANA de-registered port 585 in 2006, Apple Mail and some other email clients still probe it when the "Automatically detect and maintain account settings" option is enabled.³

Here's what happens:

1. Apple Mail probes multiple ports trying to find the right configuration
2. Port 585 gets scanned even though it hasn't been valid for 18 years
3. Security systems see the probe and flag it as suspicious activity
4. The server blocks the IP address thinking it's a port scan attack
5. The user can't connect to their email, even though they did nothing wrong

This is port 585's legacy: causing authentication failures for people just trying to check their email.

The Well-Known Ports Range

Port 585 sits in the well-known ports range (0-1023), which is managed by IANA and reserved for system services and widely-used protocols. Getting a port assigned in this range requires IETF documentation (usually an RFC) and demonstrates that the service is considered fundamental Internet infrastructure.

Being de-registered from this range is rare. It means IANA decided the port's assignment was creating more problems than it solved.

How to Fix Port 585 Issues

If you're experiencing connection problems related to port 585:

For Apple Mail users:

• Open Mail → Settings (or Preferences)
• Select your email account
• Click the "Advanced" tab
• Uncheck "Automatically detect and maintain account settings"
• Manually specify port 993 for IMAP over SSL³

For server administrators:

• Consider adding port 585 to your firewall's exception list with rate limiting
• Document that port 585 probes from Apple Mail are not attacks
• Educate support teams about this legacy behavior

For developers:

• Never configure services to use port 585
• Always use port 993 for IMAPS
• If you're building an email client, don't probe deprecated ports

How to Check What's Listening on Port 585

On Linux or macOS:

sudo lsof -i :585
# or
sudo netstat -tlnp | grep :585

On Windows:

netstat -ano | findstr :585

If something is actually listening on port 585, it's either:

• A misconfigured email server using the wrong port
• A legacy system that hasn't been updated since before 2006
• Potentially malicious software (port 585 is sometimes used by trojans precisely because it's unexpected)

Why De-registered Ports Matter

Port 585 teaches an important lesson about Internet infrastructure: deprecation is harder than it looks.

You can de-register a port. You can update the official registry. You can publish documentation telling everyone to stop using it. But you can't force every piece of software in the world to forget.

Email clients still remember port 585. Security scanners still flag it. Servers still block connections to it. The port is officially dead, but its ghost haunts mail servers around the world, causing authentication failures and support tickets for an assignment that ended in 2006.

The Internet has a long memory. Sometimes too long.