RFC 3501 states:
IMAP client and server implementations MUST implement the TLS_RSA_WITH_RC4_128_MD5.
RFC 7465 states:
o TLS clients MUST NOT include RC4 cipher suites in the ClientHello message
o TLS servers MUST NOT select an RC4 cipher suite when a TLS client sends such a cipher suite in the ClientHello message.
o If the TLS client only offers RC4 cipher suites, the TLS server MUST terminate the handshake. The TLS server MAY send the insufficient_security fatal alert in this case.
I don't see anyway to reconcile these two RFCs. I have seen that Google has turned off RC4 on its email servers and is requiring TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, but that's not necessarily interoperable with the rest of the world.
Is there an update to RFC 3501 coming that changes the mandated TLS cipher suite?