How IMAP works under the hood
blog.lohr.dev
blog.lohr.dev
Pulling large amounts of data for things like threading can be difficult on certain servers; my preferred approach ended up being to pull every ID and thread ID to maintain an in-memory tree. (This was, iirc, partially because Gmail’s implementation was slightly crippled with relation to threading.)
(I never finished the guide because I stopped on the project, alas - if IMAP were easier to work with, I might have finished it! And sadly, no JMAP support on Gmail, and the gateway was broken.)
Gmail is not "crippled". A tiny but vocal community of old nerds have a petrified mental model of email that they associate with unix IMAP software from the 1990's, but those concepts do not appear in the IMAP standards anywhere.
For context: I spent 11 years at Intel managing pre-silicon and post-silicon processor validation. No processor that does only and exactly what the Programmers Reference Manual says, and takes the phrase "undefined behavior" seriously, will be successful. Google would do well to adjust their philosophy.
Certainly I moved away to Fastmail, which has better IMAP support (but mostly because Google having full control of my email address was becoming too big of a risk and Google Apps is expensive for your own domain).
The standard document may say one thing, but what people do in the real world is the real standard. If your software has issues with the world's most popular IMAP server, you need to adjust your software to be compliant with the standard.
I'm personally more sympathetic to your actual conclusion, but it's odd how often a single argument can be used to support two conflicting beliefs.
It's really dumb that one message has* to exist in only one location for example, labels are so much better.
RFC 9051 says that it was "developed for" RFC 822 and that one should now refer to RFC 5322 instead. And RFC 5322 does discuss threading, which is the what the comment you're replying to was talking about, so that concept does appear (by reference) in the IMAP standards.
Are there other parts of the community that implement IMAP using the same "mental model of email" that Gmail is using? Or are you saying that anyone using IMAP with anything but Gmail is an old nerd and a tiny minority?
To be clear, I have no opinion on IMAP or what things _should_ do; I certainly was not using IMAP software in the 1990s :) However, trying to implement a client that works across providers does mean trying to operate per the standards, which was a struggle and why I started documenting it :)
When was OBJECTID introduced and when did gmail roll their own implementation, do you happen to know?
I would be very interested in hearing from developers about how they write email clients that need to work with all the servers out there, with the varying levels of IMAP4 (original, rev1, rev2, combinations of at least a dozen extensions) and various levels of buggy behaviour.
I'm assuming a client developer would implement various "profiles". With an "advanced" profile for servers that implement things like CONDSTORE/QRESYNC, and a "very basic" profile that only do the absolute minimum. And probably a profile or two in between. When you encounter unexpected behaviour (eg bad syntax in protocol), you would downgrade the profile for that server for a while (it may get fixed)? If it works like this, I'm curious to the profiles developer choose. If it's not like this, I wonder how client developers work around compatibility issues (can't just keep reconnecting and trying the same if it results in an error!).
The goal is to have the client work without any extensions. E.g., if the server doesn’t have the UNSELECT capability it falls back to selecting a nonexistent mailbox (which has the same effect). Obviously there are some very useful extensions that the client needs to support, but those can be viewed as optimizations to reduce network traffic or add extra features if the server supports them.
- The grammar is hard. I built a parser using lpeg and I'm incredibly glad I did--doing it ad hoc won't lead to good results.
- It's an asynchronous protocol. You can send lots of requests to a server and you have to tag them so you can match them up with responses later. You don't generally want to do that in a client; i.e. you don't want to do these transactional things over an async connection and track state across all of it. You want to like, block on deleting things, renaming things, sending things, etc.
- IMAP is multi-user--it's built around the idea of multiple clients accessing the same mailbox at the same time and streaming updates. Another thing you really don't want to deal with when building an email client.
- There's functionality that you basically shouldn't use; the big one is search. Even the specs more or less say "good luck using this".
You can group all this under the a heading of "we thought people would use this over telnet", but attachments and non-plain-text email I think made that non-viable.
I think this all means probably every non-web email client treats IMAP like POP and keeps its own store. I haven't done a survey or anything, but I'd be surprised if that weren't true.
Pretty sure mutt doesn't. It only caches the headers.
Seem like it can cache message bodies:
* http://www.mutt.org/doc/manual/#message-cachedir
* https://neomutt.org/guide/optionalfeatures.html#body-caching
And as for treating IMAP like POP, yes, there are clients that only pay lip service to "having IMAP support", only so that they can have one more green checkbox in feature list that their present in their marketing. But there are also more serious clients.
Message sequence numbers. Every folder in IMAP has its emails numbered from 1-N, with no holes, so if you delete a message, everything after it has its message sequence number decremented to close the hole. Except IMAP is multiclient, and the message can be deleted by other connections than the one you're currently on. But the server is only allowed to tell you about message deletions at certain points, so now the server has to keep essentially per-client message sequence number state and carefully make sure that everyone is kept in sync... and it's a recipe for disasters in practice. Any sane client will instead use UIDs for everything (and any sane server will implement all the UID extensions to let UIDs be used for everything).
The other fun corner case I recall is that IMAP part numbering is a little unclear what happens around body parts of content-type message/rfc822. So I crafted a message that had a multipart/mixed with one leg being a message/rfc822 whose body was a message/rfc822, and tested the output on all 4 IMAP server implementations I had accounts on at the time to see how they handled the part numbering. I got back 4 different results. None of them were considered correct by the IMAP mailing list discussion on the experiment.
> I think this all means probably every non-web email client treats IMAP like POP and keeps its own store.
The distinction I would use is thin client versus thick client. Most clients like Outlook or Thunderbird are thick clients, which need to maintain their own local database for other reasons (like supporting offline mode or having database features not necessarily supported by an IMAP server, like arbitrary tagging). If you've got a local database, it's much saner to use IMAP essentially as a database synchronization protocol rather than trying to build a second implementation of all of your features on top of IMAP's native features, especially given that IMAP server implementation of these features is generally questionable at best.
IMAP was originally designed, it seems to me, to make thin clients easy to write (I can see how something like pine would be a very thin veneer over the protocol itself). But it's been clear over the past few decades that most clients are of the thick variety; things like QRESYNC and CONDSTORE were added to make the database synchronization steps a lot easier.
Yes! Since last year there's the experimental UIDONLY extension that allows clients & servers to operate entirely without message sequence numbers. Saves quite a bit of accounting and possibly memory (for large mailboxes). It's a bit surprising the RFC so recent.
> [... thick vs thin clients ...]
For some programmatic email access, IMAP seems quite easy to use. Just write a programmer-readable line of text as command (eg fetch/search/store/etc) and parse the response lines (that's a bit trickier in many cases, probably needing a library, but you may be able to get away without it some of the time) and you're done.
About thick clients: Storage capacity is growing much harder than my email, also on mobile. I would be fine with thick clients that sync all messages. Allows for simpler protocols and simpler implementations. An email access protocol is then not much more than a two-way sync of email message files and associated "dynamic data" like flags/keywords.
But IMAP and JMAP are doing many things at once: synchronization for thick clients, and online access for thin clients. JMAP is specifically targeting the web (thin clients), so what was old is new again (although base IMAP isn't too helpful to (web-based) thin clients either).
Yes, you can match the final OK/NO/BAD responses with the original command based on the tag. The annoying thing is that each command typically sends most of its data in "untagged responses". And IMAP servers can send unsolicited untagged responses at any time too. It's quite tricky to handle all those responses correctly in email clients. Indeed, normally you just want to send a command, and get all the data for that command back until the finishing response. IMAP clients typically open multiple connections to isolate commands.
No, the grammar is too convoluted for that. It's more like "we thought text-based protocols are better".
POP3 and SMTP are relatively easy to use manually. IMAP is not.
HasChildren could have been Parent, HasNoChildren could have been Leaf or Child. And so many more things.
A modern replacement (JMAP) hasn't been adopted by major providers.
If you really cared about data transfer size you'd use something like Protobuf.
The bigger benefit of JMAP is it's well designed for dealing with deltas and changes and syncing data requiring less roundtripping than IMAP.
Of course, major providers like Gmail don't support that as well.
Maybe they thought the same when they were designing the protocol.
Also, in the context of email, given the size of each mail (including headers and body), these bytes "waste" maybe insignificant.
Kind of a surprising observation given the first spec (IMAP2) was released in 1998, when dial-up was still a thing:
* https://datatracker.ietf.org/doc/html/rfc1064
IMAP4 was in 1994:
* https://datatracker.ietf.org/doc/html/rfc1730
ITU V.32 gave us 9.6 kbit/s in 1998, and V.34 was 28.8 kbit/s in 1994:
* https://en.wikipedia.org/wiki/List_of_ITU-T_V-series_recomme...
It might have mattered back then but now it would be less than a rounding error.
Actually having a email client software running on your machine is extremely nitch and is mostly in the realm of self-hosters and legacy holdouts that won't let their clients go.
A most advanced modern approach is to just use POP3 to download your emails to a local Maildir and have them indexed there non-destructively. And then sync between your various machines that you want your email accessible using some sort of file sync or P2P solution.
I use notmuch for this. It automatically indexes and tags emails and thus enables much more advanced email management solutions then what can be offered over something like IMAP.
The main advantage of this is that 'folders' are managed virtually. There is no shuffling or copying or editing of emails done normally. I only have to worry about backing up my emails and notmuch config as all the rest can be regenerated relatively quickly.
This is more or less replicating what Gmail and other webmail providers do server side.
Where as the traditional approach shuffling and moving and deleting of emails on some imap server is fairly dangerous and expensive operation. Mistakes can lead to data loss and are often very difficult to reverse.
With Outlook, i can use a custom view to see every item in a category flagged for follow-up. I can also set a reminder on a contact, or drag an email or contact onto my calendar to create an event.
Google really doesn't want you to use IMAP. They're trying to push everyone to their neutered web apis instead.
That's just it. Lots of client developers, especially open source ones, balked.
So to use something like mutt with gmail requires a user go into their google settings, set up 2fa then create an app-specific password. And if a user is on a Google Workspace account with "insecure" passwords turned off, they either have to do all the gcloud/consent/etc. stuff themselves or steal a client secret from another client.
Oauth client secrets aren't really compatible with open source and oauth flows don't work well in terminals. Google's onerous process didn't help and on top of that, using oauth means getting hit by Google's quotas.
Who knows how long Google will support app-specific passwords? Or perhaps they'll start forcing 2fa via their own gmail app every login.
Except they do, to some degree. It works well enough that my Thunderbird allows me fetching or moving of mails. Not sure about advanced features like search or server-side filtering, never tried them, but this seems to be a bit more wacky with other clients & servicers too.
> They have each implemented their own proprietery out-of-band authentication system that only works over HTTPS using the OAuth2.0 toolkit to build it.
True. Gmail at least had a long while application-passwords. I think they changed this only recently? Or are they still a thing?
And while OAuth2 is open it is a toolkit for making protocols, not a protocol. And each megacorps implementation is different and handled differently.
Not really true. It's usually the client implementations that violate the standard in some way or another, like Outlook. But there are way more bespoke rare clients that have poor implementations.
> They have each implemented their own proprietery out-of-band authentication system that only works over HTTPS using the OAuth2.0 toolkit to build it.
Well, no. They have implemented OAuth and that's not proprietary. They do it because plain login has massive downsides.
Are you aiming to directly compete with Notion/Superhuman?
Edit: I see you're an academic, perhaps my questions are irrelevant
What this article doesn't address is OAUTH, which is required more often now.