Port reference
Port 995 (TCP) – POP3S
POP3S — POP3 mail retrieval encrypted with implicit TLS from connect.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Encrypted
- Risk level
- Low
Lower risk, but still expose it only when you actually need it.
Default state
Open on mail servers offering secure POP3. Usually exposed to the internet so clients can download mail over TLS.
What is port 995 used for?
Port 995 is POP3S, POP3 encrypted with TLS from the moment you connect. It is how a mail app downloads messages from the server to your device, usually removing them from the server afterward. Clients like Outlook, Thunderbird, and Apple Mail use it to pull mail from servers such as Dovecot. It is the secure equivalent of plain POP3 on port 110.
When would you open it?
You open port 995 if you run your own mail server and want clients to download mail over encrypted POP3. A typical case is a Dovecot setup serving users who prefer to keep messages locally rather than synced. If you use a hosted email provider, you never open this port yourself; you just enter it in your mail client.
Is it safe to open?
The encrypted channel is sound, but accounts can still be brute-forced, so enforce strong passwords, MFA, and modern TLS, and keep the server patched. See the security notes below.
How to check if this port is open
ss -tulpn | grep :995
nmap -p 995 <target>netstat -ano | findstr :995
Test-NetConnection <host> -Port 995lsof -i :995
nmap -p 995 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 995 to your device's local IP, internal port 995, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 995/tcpsudo firewall-cmd --permanent --add-port=995/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 995 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 995" -Direction Inbound -Protocol TCP -LocalPort 995 -Action AllowSecurity & risks
Common attacks
- Credential brute force and password spraying against POP3 login
- Weak/deprecated TLS exploitation and downgrade
- Account takeover via leaked/reused credentials
- Legacy/basic-auth abuse bypassing MFA
Hardening
- Require TLS 1.2/1.3 and disable weak ciphers and old protocols
- Use strong, unique passwords and enforce MFA / OAuth where possible
- Rate-limit logins and lock out brute force; alert on anomalies
- Disable legacy/basic auth and prefer IMAPS where suitable
- Keep the POP3 server patched and use valid certificates
How to block this port
sudo ufw deny 995/tcpsudo firewall-cmd --permanent --remove-port=995/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 995 -j DROPNew-NetFirewallRule -DisplayName "Block 995" -Direction Inbound -Protocol TCP -LocalPort 995 -Action Blocknmap snippet
nmap -p995 --script pop3-capabilities,ssl-enum-ciphers,ssl-cert <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 995 and 110?
- Port 110 is plain POP3 (optionally upgraded with STARTTLS); port 995 is POP3S, encrypted with implicit TLS from connect. Use 995 to keep the session always encrypted.
- Should I use POP3S (995) or IMAPS (993)?
- POP3 downloads and often deletes mail from the server; IMAP keeps it synchronised across devices. For multi-device access prefer IMAPS (993); either way enforce TLS and MFA.