Connect Zimbra to Claude,
Cursor, ChatGPT and any MCP client
Zimbra has held your organisation's mail for years, and it speaks perfectly ordinary IMAP. That is all an AI agent needs to read, search, send, reply, schedule and file inside a real mailbox.
Claude cannot reach a Zimbra server on its own. mcpemails is a hosted MCP server that connects to yours over IMAP at your own hostname, on port 993 where the Zimbra proxy is installed, using the mailbox password, so Claude, Cursor or any MCP client can read, search, send and organize that mail. Zimbra is software your organisation runs, so there is no shared hostname to publish, and the port is worth checking rather than assuming: 993 and 143 belong to the Zimbra proxy, while mailboxd itself listens on 7993 and 7143. The server has to be reachable from the internet and its certificate has to validate. One inbox is free.
How Zimbra connects: the proxy in front, mailboxd behind
Zimbra's IMAP arrangement has two layers, and knowing which one you are talking to saves an afternoon. The built-in IMAP server runs inside the zimbra-mailboxd process and is installed by default, controlled by zimbraImapServerEnabled and zimbraImapSSLServerEnabled, both of which default to TRUE. Its own ports are zimbraImapBindPort, defaulting to 7143, and zimbraImapSSLBindPort, defaulting to 7993. The familiar 143 and 993 are the proxy's ports, zimbraImapProxyBindPort and zimbraImapSSLProxyBindPort, served by the Zimbra IMAP and POP proxy, which inspects the connection and routes it to whichever mailbox server holds that account. Newer releases also ship a standalone zimbra-imapd alongside the in-process server. Credentials are the ordinary mailbox password, the same one used for the Zimbra Web Client. Zimbra has no app-password mechanism.
A Zimbra inbox your agent can actually use
Seventeen action-based MCP tools: send, reply, forward, schedule, and organize. Your agent finishes the job inside Zimbra.
- 01Read
Read & search mail
List, read and search across folders to find that invoice, summarize a thread, or pull the latest from a sender.
- 02Send
Send, reply & forward
Compose and send real messages, reply in-thread, and forward, directly from your mailbox, not as a draft you finish by hand.
- 03Schedule
Schedule for later
Queue a message to go out at the right time, so your agent can draft now and send on schedule.
- 04Organize
Move, copy, flag, archive, delete
Keep the inbox tidy: file mail into folders, flag what matters, archive the rest, or delete on request.
Connect Zimbra in four steps
From sign-up to first AI email in a couple of minutes.
Create your free mcpemails account
Sign up at mcpemails.com. One inbox is free forever and no card is required, which is enough to try this against a real Zimbra account.
Confirm IMAP is enabled and find the port that answers
In the admin console, open Configure, then Global Settings, then IMAP, and check Enable IMAP services and Enable SSL for IMAP service. Then confirm which port is actually listening from outside: openssl s_client -connect mail.yourdomain.com:993, and if that is silent, try 7993. On the server, zmprov gs yourserver reports the bind ports it is using.
Check the class of service, then add the account
Open Configure, then Class of Service, then the class the account belongs to, and look at the POP/IMAP options under Preferences. A class with IMAP switched off refuses every account in it. Then add the inbox in mcpemails: choose IMAP / SMTP, enter your Zimbra hostname, the full address and the mailbox password.
Paste the MCP URL into your AI
Drop https://mcpemails.com/api/mcp into Claude, Cursor or ChatGPT, authorize, and your agent has the inbox.
Comparing providers first? See the email provider compatibility matrix
What actually goes wrong with Zimbra
Port 993 belongs to the proxy, so a server without one answers on 7993
Zimbra's mailbox process does not listen on 993. It listens on 7993 for IMAP over SSL and 7143 for plain IMAP, and the standard ports are served by the separate Zimbra IMAP and POP proxy package, which forwards each connection to the right mailbox store. On a single-server install where zimbra-proxy was never selected, or on one where an administrator removed it, nothing answers 993 at all and the client reports a connection refused that looks like a firewall problem. Use 7993 in that case, but understand the trade: on a multi-server deployment the proxy is what knows which store holds a given account, so connecting straight to a node's 7993 works only if the mailbox actually lives on that node. If you have more than one mailbox server, restoring the proxy is the right answer rather than routing around it.
The certificate on 993 is the proxy's, and it is self-signed until somebody changes it
Because the proxy terminates the connection, the certificate a client validates on 993 is the one nginx is holding, not necessarily the one mailboxd presents on 7993. The two can differ, which is how a server passes a check on one port and fails on the other. Zimbra also installs a self-signed certificate at setup, and plenty of deployments never replaced it because the web client is reached through something else or because everybody clicked past the warning in 2019. Certificates are deployed with zmcertmgr and viewed in the admin console, but the only test that counts is what is on the wire: run openssl s_client -connect mail.yourdomain.com:993 from a machine outside and read the chain it returns. Strict validation is not optional on our side, so a self-signed or expired certificate ends the conversation before authentication.
IMAP can be switched off in four separate places
Zimbra layers its configuration, and each layer can refuse a connection on its own while the others look correct. Global settings, under Configure then Global Settings then IMAP, carry the master Enable IMAP services switch. Each server has its own settings where the IMAP and IMAP SSL port numbers are set and the in-process server can be turned off, via zimbraImapServerEnabled and zimbraImapSSLServerEnabled. Each class of service carries POP and IMAP options that apply to every account in it. And an individual account can override its class. The command line reads them in the same order: zmprov gcf for global config, zmprov gs for a server, zmprov gc for a class of service and zmprov ga for an account. Work down that list rather than guessing, because the failure looks identical at every level.
Known limits with Zimbra
- Your Zimbra server has to accept an inbound IMAP connection from the internet. A deployment published only inside the corporate network or behind a VPN cannot be reached by a hosted service. mcpemails can be self-hosted inside the same network instead, which is often the easier conversation to have with a security team than opening a port.
- Only mail crosses an IMAP connection. Zimbra's calendars, contacts, tasks and briefcase are served through its own web client and through CalDAV, CardDAV or the Zimbra API, so an agent connected this way works with mail alone.
- Sending goes out through your own Zimbra MTA, so deliverability is governed by your SPF, DKIM and DMARC records exactly as it is for every other client on the server.
Zimbra and AI: common questions
Does Claude work with Zimbra?
Not directly. Claude has no Zimbra connector and cannot open an IMAP session to a server your organisation runs. Connecting an MCP server such as mcpemails to your Zimbra host gives Claude read, search, send, reply, schedule and organize access to a mailbox on it, using the same credentials the Zimbra Web Client uses, and the same inbox then works in Cursor or ChatGPT.
What are the Zimbra IMAP and SMTP settings?
The hostname is your own Zimbra server. IMAP is 993 with implicit TLS and 143 with STARTTLS when the Zimbra proxy is installed, which is the usual case. Without the proxy, mailboxd's own ports are 7993 and 7143. Submission is normally 587 with STARTTLS or 465 with implicit TLS. Log in with the full account address and the mailbox password.
Why does nothing answer on port 993?
Most likely the Zimbra IMAP and POP proxy is not installed or has been disabled, because 993 and 143 are the proxy's ports rather than the mailbox server's. Try 7993, which is the default for zimbraImapSSLBindPort on mailboxd itself. On a deployment with several mailbox servers, reinstating the proxy is better than connecting to a node directly.
Why is my Zimbra password rejected when webmail works?
Because web access and IMAP access are separate permissions. Check the POP and IMAP options on the account's class of service first, then the account's own overrides, then whether IMAP services are enabled in Global Settings. Any one of those can refuse an IMAP login while the Zimbra Web Client carries on working normally.
Does Zimbra need an app password?
No. Zimbra issues no app-specific passwords, and a mail client authenticates with the account's own password. If your deployment uses two-factor authentication for the web client, check with your administrator how it is configured for mail clients, since that policy is set per class of service rather than by Zimbra globally.
Is my Zimbra mail stored on your servers?
No. Messages are fetched live from your Zimbra server over IMAP for each request and passed to your AI client. Credentials are encrypted at rest and message bodies are not retained.
Give your AI a Zimbra inbox
Connect a mailbox from your own Zimbra server. One inbox free forever, no card required.