Port 995 (POP3S)

What port 995 is

TCP port 995 is POP3 over TLS, often called POP3S. A mail client connects, the TLS handshake happens first, and only then does the POP3 conversation start. It is the encrypted counterpart of plain POP3 on port 110. RFC 8314 recommends implicit TLS like this for mail clients, rather than upgrading a plain connection with STLS.

POP3 downloads messages to one device and, by default, deletes them from the server. If you read mail on several devices, IMAP on port 993 is usually the better choice.

Should it be open to the internet?

Only on a mail server whose users fetch mail with POP3 from outside your network. If nobody uses POP3, turn the service off rather than just firewalling it. If you do offer POP3, offer 995 and close 110, so passwords never cross the network in clear text.

In Dovecot, the most common POP3 server on Linux, the listener is set in the pop3-login service:

service pop3-login {
  inet_listener pop3 {
    port = 0
  }
  inet_listener pop3s {
    port = 995
    ssl = yes
  }
}

Setting port = 0 disables the plain listener. Your protocols line must include pop3 for either to start.

Firewall rules

With ufw:

sudo ufw allow 995/tcp
sudo ufw deny 110/tcp

With iptables:

sudo iptables -A INPUT -p tcp --dport 995 -j ACCEPT

How to check what is listening

On the server itself:

sudo ss -tlnp | grep ':995'
sudo lsof -i :995

From another machine, test the TLS handshake and the certificate the server presents:

openssl s_client -connect mail.example.com:995 -quiet

A working server answers with a greeting starting with +OK. You can then type USER and PASS by hand if you need to debug a login. Check that the certificate covers the exact hostname your clients use, or they will show a warning.

Security notes

• Brute force. POP3 logins are a frequent target. Use fail2ban or your server's built-in rate limiting, and consider app passwords instead of the main account password.
• Certificates. An expired certificate on 995 breaks every client at once. Renew it on the same schedule as your web certificate and reload Dovecot after renewal.
• Old TLS versions. Disable TLS 1.0 and 1.1; in Dovecot set ssl_min_protocol = TLSv1.2.
• Providers. Many hosted mail providers have disabled POP3 or plain password logins. If a client suddenly fails on 995, check the provider's current settings before debugging the network.

Related ports

• Port 110: plain POP3.
• Port 993: IMAP over TLS.
• Port 587: mail submission, for sending.
• Port 25: server-to-server SMTP.

To see which mail ports a server exposes to the internet, run it through the Port Scanner, and check the certificate with the SSL Checker.