Port 110 – POP3

TCP

Port 110 is the POP3 port for downloading email from a mail server. POP3 downloads messages to the local device and typically deletes them from the server – unsuitable for multi-device access. Port 995 (POP3S) uses TLS. Port 110 is plaintext and should not be used without STARTTLS.

Port Number

110

Protocol

TCP

Service

Post Office Protocol v3

Range

IANA Well-Known (0–1023)

Description

POP3 on port 110 provides simple email download – connect, authenticate, retrieve messages, optionally delete from server, disconnect. Unlike IMAP, POP3 has no concept of folders or server-side state beyond inbox. Modern email clients prefer IMAP (port 143/993) for multi-device synchronization. POP3 with STARTTLS upgrades the plaintext connection to TLS.

Security risks

1Cleartext credentials: POP3 on port 110 sends USER and PASS commands in plaintext. Any network observer captures email credentials. Always use POP3S (port 995) or require STARTTLS before authentication.
2No server-side state: POP3 downloads and deletes mail. If an attacker captures credentials and connects first, they download all new mail before the legitimate user sees it – with no trace on the server.
3Brute-force attacks: POP3 has no built-in rate limiting. Attackers brute-force email passwords via port 110. Configure fail2ban to monitor /var/log/mail.log for authentication failures.

Firewall guidance

Disable port 110 entirely and use only port 995 (POP3S) or migrate to IMAP on 993. If legacy clients require port 110, enforce STARTTLS before AUTH (Dovecot: disable_plaintext_auth=yes). Block port 110 at the perimeter firewall for outbound connections – legitimate mail clients should use encrypted ports.

Diagnosis commands

Test STARTTLS support on POP3 port 110

shell

openssl s_client -connect host:110 -starttls pop3

Basic POP3 connectivity – should see +OK banner

shell

telnet host 110

Enumerate POP3 server capabilities including STLS support

shell

nmap -p 110 --script pop3-capabilities target

Usage examples

Port 110 – POP3

shell

openssl s_client -connect mail.example.com:995
USER [email protected]
PASS secret
LIST
RETR 1
QUIT

Common services on this port

DovecotCourierCyrus IMAP/POP3Microsoft ExchangehMailServerZimbra

Related ports

995

POP3S (implicit TLS)

143

IMAP (server-side mail)

993

IMAPS (secure IMAP)

History

POP3 was defined in RFC 1939 (1996). The original POP (RFC 918, 1984) was far simpler. POP3 became the dominant email retrieval protocol before IMAP gained widespread adoption in the 2000s. With multi-device email access now standard, POP3 is effectively legacy.

FAQ

Should I use POP3 or IMAP?

IMAP (port 993) for almost everyone – it keeps mail on the server, syncs across devices, and supports folders. POP3 only makes sense for single-device setups where you want a local archive (download and delete from server) or for compliance scenarios requiring no server-side email retention.

Specification

RFC 1939 – Port 110 specification →