Skip to content
Webmaster Tools
SecurityPort ScannerPort 110 (POP3)

Port 110 (POP3)

Port 110 is POP3, a protocol for downloading email from a mailbox. How it differs from IMAP, STARTTLS vs port 995, and whether to keep it open.

What runs on port 110

TCP port 110 is POP3, the Post Office Protocol version 3 (RFC 1939). A mail client connects, logs in, downloads the messages in the mailbox and, by default, deletes them from the server. It is one of two ways clients read mail; the other is IMAP on port 143 or 993.

POP3 on port 110 starts unencrypted. Clients can upgrade the connection with the STLS command (RFC 2595), the POP3 version of STARTTLS. Without it, the username and password cross the network in clear text. The encrypted-from-the-start version, POP3S, uses port 995.

POP3 vs IMAP

POP3 (110 / 995) IMAP (143 / 993)
Where mail lives Downloaded to one device Stays on the server
Folders Inbox only Full folder tree
Several devices Messages end up on whichever device fetched first Same view everywhere
Read and flag state Not synced Synced

POP3 is still used by some ticketing and helpdesk systems that pull from a mailbox, by scripts that process incoming mail, and by people who want a local archive. For a person reading mail on a phone and a laptop, IMAP is the better choice.

Should it be open to the internet?

Only if you run a mail server and someone really needs POP3. If you do:

  • Prefer port 995 with implicit TLS. RFC 8314 recommends implicit TLS over STARTTLS for mail clients.
  • If you keep 110, require STLS before login. In Dovecot 2.3: ssl = required and disable_plaintext_auth = yes (newer releases renamed some of these settings, so check the documentation for your version).
  • If nobody uses POP3, turn it off. In Dovecot, remove pop3 from protocols:
# /etc/dovecot/dovecot.conf
protocols = imap lmtp

Firewall:

sudo ufw allow 995/tcp
sudo ufw deny 110/tcp

iptables -A INPUT -p tcp --dport 110 -j DROP

Test it by hand

openssl s_client -connect mail.example.com:110 -starttls pop3

A certificate chain followed by +OK means STLS works. For 995: openssl s_client -connect mail.example.com:995. On the plain port, nc mail.example.com 110 should show a +OK greeting; type CAPA to see if STLS is offered, and QUIT to leave.

See what is listening

sudo ss -tlnp 'sport = :110'
sudo lsof -i :110

The process is usually dovecot (or Courier on older setups). On hosting control panels the mail stack often enables POP3 by default even if no customer uses it.

Security notes

  • Clear-text passwords on 110 without STLS are visible to anyone on the path. Treat them as exposed.
  • Brute force: POP3 logins are a common target for password spraying. Use fail2ban or Dovecot's auth penalty, and strong passwords or app passwords.
  • Certificates: use a valid certificate for the hostname clients connect to, such as mail.example.com, or clients will warn or refuse.
  • Mail lost to the wrong device: a forgotten old phone set to POP3 with "delete from server" can quietly empty the inbox.

See which mail ports your server exposes with the Port Scanner.