Port reference
Port 110 (TCP) – POP3
Mail retrieval protocol that downloads messages from a server to a client, in cleartext by default.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on mail servers offering POP3 access; sometimes exposed to the internet alongside POP3S on 995.
What is port 110 used for?
Port 110 is the default port for POP3 (Post Office Protocol version 3), which downloads email from a mail server to a single device, usually deleting it from the server afterward. Mail clients like Outlook, Thunderbird, and Apple Mail can use it, and mail servers such as Dovecot offer it. It is the older sibling of IMAP (port 143); the encrypted version is POP3S on port 995.
When would you open it?
You'd open or forward port 110 only if you run a mail server and need clients to collect mail over plain POP3. Most setups today prefer the encrypted POP3S on 995, so you typically only keep 110 open for legacy clients that can't do implicit TLS.
Is it safe to open?
Plain POP3 sends your password and messages in cleartext, so anyone watching the network can read them; use POP3S on 995 or enforce STARTTLS so the session is encrypted. See the security notes below.
How to check if this port is open
ss -tulpn | grep :110
nmap -p 110 <target>netstat -ano | findstr :110
Test-NetConnection <host> -Port 110lsof -i :110
nmap -p 110 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 110 to your device's local IP, internal port 110, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 110/tcpsudo firewall-cmd --permanent --add-port=110/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 110 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 110" -Direction Inbound -Protocol TCP -LocalPort 110 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Cleartext credential and message capture via sniffing
- Credential brute force and password spraying
- STARTTLS stripping / downgrade to cleartext
- Reuse of harvested credentials against other services
Hardening
- Use POP3S on port 995 (implicit TLS), or enforce STARTTLS on 110
- Disable plaintext logins; require TLS before authentication
- Add rate limiting / lockout and enforce strong passwords or MFA
- Restrict access by source IP or VPN where possible
How to block this port
sudo ufw deny 110/tcpsudo firewall-cmd --permanent --remove-port=110/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 110 -j DROPNew-NetFirewallRule -DisplayName "Block 110" -Direction Inbound -Protocol TCP -LocalPort 110 -Action Blocknmap snippet
nmap -p110 --script pop3-capabilities,pop3-ntlm-info,banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is POP3 on port 110 secure?
- Not by default. Plain POP3 on port 110 sends the username, password, and messages in cleartext. Use POP3S on port 995 or enforce STARTTLS so the session is encrypted.
- What is the difference between port 110 and 995?
- Port 110 is plain POP3 (cleartext unless STARTTLS is negotiated). Port 995 is POP3S, which wraps the session in TLS from the start, encrypting credentials and mail.