The sixty-second answer
Set up every device using IMAP, never POP3. IMAP treats the server as the single source of truth, so a message read or filed on your phone is read and filed on your laptop too. Use IMAP over TLS on port 993 to receive, and the submission port 587 to send. That is the whole decision.
The choice that decides everything
When you add a mail account to a phone or a laptop, one screen asks whether you want IMAP or POP. Most people click past it. That single choice is the difference between email that behaves like a modern service and email that behaves like it did in 1998.
IMAP keeps your mail on the server and lets each device manipulate it in place. The standard describes it as permitting "manipulation of mailboxes (remote message folders) in a way that is functionally equivalent to local folders", including creating and renaming folders, checking for new messages, setting and clearing flags, searching, and fetching parts of messages [1]. Every device is a window onto the same mailbox.
POP3 does something narrower and older. Its own specification says it exists "to allow a workstation to retrieve mail that the server is holding for it", and states plainly that it "is not intended to provide extensive manipulation operations of mail on the server", pointing readers at IMAP for that [2]. POP was designed for one computer, occasionally connected, that pulled mail down and kept it locally.
Put POP3 on two devices and you get the classic small-business complaint: mail that appears on the laptop and vanishes from the phone, sent messages that exist in only one place, and a folder structure that has to be rebuilt by hand on every machine. The fix is not a better app. The fix is to delete the account and re-add it as IMAP.
The settings that actually matter
There are only four values, and two of them are your address and password. The other two are the incoming and outgoing servers.
Incoming: IMAP over TLS, port 993. This is Implicit TLS, meaning the connection is encrypted before a single byte of mail protocol is spoken. The specification is explicit: when a TCP connection is established for the "imaps" service on the default port 993, "the TLS handshake begins immediately" [3]. The alternative - connecting in the clear and asking to upgrade afterwards - leaves a window in which the upgrade can be stripped. If your provider offers only an unencrypted option, that is a reason to leave, not a setting to accept. We go through the layers involved in is your business email actually encrypted.
Outgoing: submission, port 587. Sending mail from a mail client is a different job from one mail server handing a message to another, and the standards separate them deliberately. "Port 587 is reserved for email message submission", while relay between servers continues on port 25; the separation exists so that specific security and policy requirements can be applied to submission [4]. Practically, this matters because many networks - hotel Wi-Fi, mobile carriers, some office firewalls - block port 25 outright. A client configured to send on 25 will work at home and fail everywhere else, which is exactly the symptom that gets reported as "my email works on my laptop but not my phone".
Authentication is required on submission. If your outgoing settings have no username and password, mail will either be refused or, worse, accepted by something it should not be going through.
You may not have to type any of that
A well-configured domain can tell your mail app where to connect. RFC 6186 defines SRV records that let a client take the domain part of your email address and look up the right hosts and ports, with the worked example of a submission record pointing at port 587 on the mail host, plus equivalent labels for IMAP access [5]. Where those records exist, setup is your address and your password, and nothing else.
This is worth asking a provider about directly. "Do you publish autodiscovery records for my domain?" is a fast way to find out whether onboarding is going to involve a support call for every device in your business.
Doing it on each device
The order that causes the least pain is: laptop first, phone second, tablet last. Set up the laptop, confirm you can both receive and send from it, and only then move on. If sending fails, the fault is almost always the submission port or the authentication, and you want to find that out once rather than three times.
On the phone, resist the "other" or "advanced" path if the app offers to configure the account automatically. If it asks for an account type, choose IMAP. If it asks about outgoing security, choose the encrypted option and the submission port. If it offers to keep messages on the server, say yes - that is not an option under IMAP so much as a leftover POP question that some apps still display.
Then test the thing that actually matters: send a message from the phone, and check that it appears in the Sent folder on the laptop. If it does not, the phone is storing sent mail locally and you have not really got one mailbox, you have two devices pretending.
What syncing does and does not protect
IMAP is synchronisation, not backup. When a message is deleted, the server is told, and every connected client is told in turn - servers that allow simultaneous access to a mailbox are expected to send unilateral updates when another agent changes flags or expunges messages [1]. That is the feature. It also means a mistaken deletion propagates to every device in seconds.
So keep the two ideas separate. Sync means every device sees the same mailbox. Backup means a copy exists somewhere the mailbox cannot reach. If you need the second, read how to back up business email in Canada. And if the mailbox is going to grow faster than you expect once every device is syncing everything, how much email storage a business actually needs covers the sizing.
Work email on personal phones
Once your business email is on a phone, it is on a device you probably do not own. That is usually fine and occasionally a problem, and the difference is whether you decided in advance.
Business mail contains other people's personal information - customer addresses, medical details in some trades, financial information in others. PIPEDA's Schedule 1 requires that personal information not be used or disclosed for purposes other than those for which it was collected without consent, and clause 4.5.3 requires that information no longer required be destroyed, erased or made anonymous, with organisations developing guidelines and implementing procedures to govern that destruction [6]. A phone in a drawer after someone leaves is a bad place for that information to live.
The minimum viable policy is three lines: devices carrying company mail must have a screen lock and device encryption; the account is removed when the person leaves or the device is replaced; and the business can revoke access without needing the handset. The related mechanics are in what to do with an employee's email account when they leave.
Where we sit
MapleMail is Canadian-hosted business email on your own domain, and IMAP access is not an upgrade tier - it is how the service works. You get the same mailbox from a laptop, a phone, a tablet and a webmail window, with encrypted connections on the standard ports and the mail itself held on infrastructure in Canada.
Because IMAP is a published standard rather than a proprietary sync protocol, you are also not locked in: any standards-compliant client works, and the mail can be copied out of the mailbox by the same protocol that puts it in. If that day comes, switching business email providers without losing mail describes the process honestly.
Current plans and what each mailbox includes are on the pricing page. What we will say here is the part that does not change: every device, one mailbox, encrypted in transit, and no per-device charge - because a device is not a customer.