Port 110 POP3 – Free, Online, Private

What listens on 110

Port 110 is POP3. The IANA name is pop3. A client connects, authenticates, and downloads mail, usually removing it from the server. The protocol is a short set of text commands. STARTTLS can upgrade the cleartext session. Implicit TLS belongs on 995, pop3s. POP3 is a retrieval protocol. It is not SMTP. Sending mail is port 587 or 25. Many providers have turned POP3 off because IMAP keeps mail on the server and matches how people use more than one device.

The IANA service name is pop3: Post Office Protocol - Version 3. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 110. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 110

Service notes for port 110: the IANA name is pop3 (Post Office Protocol - Version 3), and the program people mean is POP3. TCP 110 is the IANA pop3 port, cleartext Post Office Protocol. POP3 over TLS is 995. Cleartext POP3 sends the password on port 110 unless the client actually negotiates STARTTLS and verifies the certificate. Prefer 995, or do not offer POP3. A public listener with the default mailbox password is a full mailbox compromise, not a theoretical one. If the daemon is enabled because a package installed it, and nobody uses it, close it. An exposed POP3 port shows up in every scan and is only useful to you if a client still needs it. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 110, you are on the wrong page.

A client configured for SSL on port 110 will fail immediately, because it speaks TLS to a cleartext banner. The fix is port 995, or STARTTLS on 110, not a second daemon. A firewall that opens 110 and not 995 is the reverse mistake. Another trap is a host that answers POP3 because a control panel enabled it for one user and bound every address. Check the listen address.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 110 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. A banner that starts with +OK is POP3. nc -vz proves TCP. openssl s_client is the wrong tool on 110 unless you are testing STARTTLS. On 995 you start with TLS.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• Port 995 is pop3s, TLS from the first byte. Port 110 is not.
• POP3 does not send mail. Submission is 587.
• A +OK banner is not authentication. It only means a POP3 server spoke.
• UDP 110 is in the registry and is not POP3 in practice.

Linuxsudo ss -lptn 'sport = :110'
sudo lsof -nP -iTCP:110 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:110 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.110[^0-9]'

Windowsnetstat -ano | findstr :110
Get-NetTCPConnection -LocalPort 110

Remotenc -vz host 110