When migrating to Zimbra, I don’t want people to fiddle with their mail when I’m doing it, so I disable IMAP access from anything but the virtual machine instance in which Zimbra is running. I do that with this: 

iptables -A INPUT ! -s 192.168.1.106 -p tcp --dport 143 -j REJECT