Port 995 POP3S – Free, Online, Private

What listens on 995

Port 995 is implicit TLS for POP3. The IANA name is pop3s. The TCP description is POP3 over TLS protocol, RFC 8314. The client speaks TLS first, then POP3 commands such as USER, PASS, or AUTH, RETR, and DELE. Port 110 is the cleartext port. A client that uses 'SSL' must use 995. A client that uses STARTTLS must use 110. The registry also has a UDP row with an older description, pop3 protocol over TLS/SSL. POP3 clients use TCP. IMAP on 993 is a different protocol and a different mailbox model. POP3 usually downloads and deletes. IMAP usually leaves mail on the server.

The IANA service name is pop3s: POP3 over TLS protocol. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 995. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 995

Service notes for port 995: the IANA name is pop3s (POP3 over TLS protocol), and the program people mean is POP3S. TCP 995 is the IANA pop3s port, POP3 over TLS from the first byte. Cleartext POP3 is port 110. The same password rules as any mail login apply. Do not offer cleartext authentication on 110 if 995 exists for every client you support. A POP3 server that deletes mail on retrieval will destroy the only copy if a client is mis-set. That is a data-loss setting, not a port setting, and it is the reason many operators prefer IMAP. The TLS certificate name still has to match. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 995, you are on the wrong page.

Users type 993 out of habit because that is the number their previous provider used for IMAP, and the POP3 server on 995 never sees them. Confirm the protocol, not only that some mail port answers. Another failure is a firewall allowing 110 and 995 but the daemon bound only to 110. Another is testing with nc and expecting +OK. On 995 the first bytes are TLS, so the +OK comes after the handshake. A certificate for the wrong name fails in the same way as on 993.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 995 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. Look for a TCP listener on 995, then a TLS handshake that yields a POP3 greeting. Port 110 answering is not evidence that 995 is configured.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• 995 is POP3S. 993 is IMAPS. They are not substitutes.
• 110 is cleartext POP3. STARTTLS belongs there, not on 995.
• The practical transport is TCP.
• A successful TLS handshake is not a successful login.

Linuxsudo ss -lptn 'sport = :995'
sudo lsof -nP -iTCP:995 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:995 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.995[^0-9]'

Windowsnetstat -ano | findstr :995
Get-NetTCPConnection -LocalPort 995

Remotenc -vz host 995