FWIW, it was a cert / key issue - the autorenewed ones from certbot didn't fully update across everything. Linking (ln -s) the /opt/zextras/conf/smptd.key and smptd.crt to the certbot generated ones and doing `zmproxyctl restart` did the trick. 

Double checking that 7993 Imap Server is running does show a process: 

root@mail:/opt/zextras/log# netstat -plnt | grep 993
tcp        0      0 127.78.0.6:10000        0.0.0.0:*               LISTEN      993/python3
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN      4115608/nginx: mast
tcp        0      0 0.0.0.0:7993            0.0.0.0:*               LISTEN      4102591/java

removed link also shows the Secure Imap Service start:

2025-05-29 16:40:53,266 INFO   [] imap - Starting ImapSSLServer on  removed link 

I do find another error that indicates a potential problem with the Imap Secure Service: 

2025/05/29 18:25:23  4115610#4115610: *969 recv() failed (111: Connection refused) while reading response from upstream, client: x.x.x.x:21290, server: 0.0.0.0:993, login: "USER", upstream: FDNN:7143 (x.x.x.x:21290->y.y.y.y:993) <=> (z.z.z.z:38150->)

I'm wondering how to get logs directly from that service, or enable more verbose debugging logs. It appears those end up in removed link but a search of /opt/zextras/conf doesn't have any obvious loglevels to set. Any ideas on how to troubleshoot the backend service further?

I thought 143->7143 and 993->7993, but I have never looked it up.

Maybe 993 is redirected to unsecure 7143 as internal security is not needed?

Is unsecured IMAP enabled on the server?

//Sigtrap

• WORKS: Carbonio Mail App
• WORKS: Carbonio webmail site
• FAILS: IMAP Clients (like Outlook, phone Mail apps)

Based on logs, it appears to be the internal IMAP Service running on `port 7143` not working: 

==> nginx.log <==
2025/05/28 17:25:22  3506083#3506083: *32 recv() failed (111: Connection refused) while reading response from upstream, client: Y.Y.Y.65:60634, server: 0.0.0.0:993, login: "USEREMAIL" upstream: FQDN:7143 (Y.Y.Y.65:60634->X.X.X.25:993) <=> (10.10.Z.Z:48966->)

Services appear to be enabled, but it is peculiar that no service (per `netstat` is listening on that port):

$ zmprov gs `zmhostname` | grep zimbraService*
zimbraServiceEnabled: service
zimbraServiceEnabled: mailbox
zimbraServiceEnabled: stats
zimbraServiceEnabled: mta
zimbraServiceEnabled: proxy
zimbraServiceEnabled: directory-server
zimbraServiceEnabled: antivirus
zimbraServiceEnabled: memcached
zimbraServiceEnabled: service-discover
zimbraServiceEnabled: opendkim
zimbraServiceEnabled: antispam

zimbraServiceHostname: HOSTFQDN
zimbraServiceInstalled: proxy
zimbraServiceInstalled: memcached
zimbraServiceInstalled: directory-server
zimbraServiceInstalled: antivirus
zimbraServiceInstalled: stats
zimbraServiceInstalled: mailbox
zimbraServiceInstalled: mta

$ sudo netstat -pnlt | grep 7143
<NOTHING>

zmcontrol -v
Carbonio Release 25.3.1

zextras@mail:/home/USER$ zmcontrol status
Host HOST
	antispam                Running
	antivirus               Running
	directory-server        Running
	mailbox                 Running
	memcached               Running
	mta                     Running
	opendkim                Running
	proxy                   Running
	service webapp          Running
	service-discover        Running
	stats                   Running
	config service          Running

What are some things to look at to ensure the IMAP service is running from here? I can't seem to find docs or relevant forum posts to help from here...