110

Port 110/tcp carries the Post Office Protocol version 3, the simple mail-retrieval protocol designed to download messages to a single client and (optionally) delete them from the server. That download-and-go model suits single-device or offline use and is the main behavioral contrast with IMAP, which keeps mail on the server and synchronizes state across devices. POP3 is stateful but minimal, moving through AUTHORIZATION → TRANSACTION → UPDATE phases with a small command set (USER/PASS or APOP, STAT, LIST, RETR, DELE, QUIT). On port 110 the session is cleartext and may be upgraded to TLS with the STLS command (RFC 2595), advertised via CAPA (RFC 2449). Notably, the IANA registry cites *no RFC* for the pop3/110 assignment — the entry's reference field is blank and it is attributed to Marshall Rose — so the governing protocol specification is RFC 1939 (May 1996, STD 53), which is not the same thing as an IANA-cited reference. The core risk on 110 is plaintext exposure of credentials and message content when TLS is not used; the older APOP challenge-response scheme relied on MD5 and is weakened by MD5 collision/key-recovery attacks. RFC 8314 deprecates cleartext POP3 in favor of implicit TLS on 995. For an analyst, an open 110/tcp suggests a POP3 mailbox server, frequently a legacy one; confirm STLS support and whether it is enforced, and flag any server that accepts cleartext USER/PASS.

IANA assignment

pop3 — "Post Office Protocol - Version 3"; reference (blank — no RFC cited in IANA registry); assignee Marshall Rose; governing protocol RFC 1939 / STD 53 (not the IANA-cited reference) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency 0.077142 [Well-established] — nmap-services file

Related ports

995 (POP3 over implicit TLS); SRV label _pop3._tcp (RFC 6186)

Primary use

simple single-client mail retrieval (download, optionally delete from server)

Other/unofficial uses

none notable beyond POP3 itself; KPOP (Kerberized POP3) uses TCP 1109, not 110

Security implications

cleartext credentials/content without TLS; APOP (MD5 challenge-response) weakened by MD5 attacks; RFC 8314 deprecates cleartext POP3 in favor of 995

Typically seen on

POP3 mailbox servers (Dovecot, Courier), legacy/consumer mail hosts

Analyst note

Open 110/tcp suggests a POP3 mailbox server, often legacy. Confirm STLS support/enforcement; flag cleartext USER/PASS acceptance.

Port 110/udp is registered with IANA as pop3 with the description "Post Office Protocol - Version 3," assignee Marshall Rose, and a blank reference field (the row is dual-registered on both TCP and UDP at port 110). In practice the UDP assignment is a dormant legacy mirror: POP3 is a connection-oriented protocol that depends on TCP's ordered, reliable delivery, and the normative POP3 standard, RFC 1939, specifies TCP port 110 exclusively. No RFC defines POP3 over UDP, and no mainstream mail client (Outlook, Thunderbird, Apple Mail) or mail server (Dovecot, Courier, Microsoft Exchange) implements or binds the UDP port — they use 110/tcp (cleartext) or 995/tcp (POP3S over TLS). The dual TCP/UDP registration reflects the historical IANA practice of reserving both transports for a well-known port number rather than any real UDP service. For an analyst, the meaningful POP3 attack surface is entirely on TCP: 110/tcp carries credentials and message bodies in cleartext (a sniffing and credential-stuffing target), and SANS ISC shows sustained scanning of port 110 on TCP. The UDP port has no documented exploit, trojan, or active scanning campaign; a POP3 host running no UDP service there typically answers a UDP probe with an ICMP port-unreachable, so any 110/udp traffic is best read as scanner noise or spoofed packets rather than a live service. Treat an unexpectedly responsive 110/udp as an anomaly worth investigating, not a normal POP3 deployment.

IANA assignment

pop3 — "Post Office Protocol - Version 3"; reference (blank — no RFC cited in IANA registry); assignee Marshall Rose; dual-registered 110/tcp + 110/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry / the IANA Service Name and Transport Protocol Port Number Registry line 290

Range class

well-known (0–1023) [Confirmed]

Registration / modification date

blank in the IANA registry row — recorded as null, not fabricated [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 290

Related ports

110/tcp (active POP3), 995/tcp (POP3S), 143/tcp (IMAP), 993/tcp (IMAPS), 25/tcp (SMTP)

Primary use

none in practice — legacy IANA mirror of the 110/tcp assignment; POP3 is TCP-only (RFC 1939), no RFC defines POP3 over UDP

Other/unofficial uses

none known; no software binds or implements POP3 over UDP

Security implications (UDP-specific)

no documented exploit, trojan, or scan campaign targets 110/udp; a host with no UDP service typically returns ICMP port-unreachable; UDP traffic to 110 is scanner noise or spoofed packets

Security implications (TCP context, for contrast)

110/tcp transmits credentials and email in cleartext (sniffing / credential-stuffing target); encrypted alternative is 995/tcp (POP3S) or STARTTLS on 110/tcp; SANS ISC documents persistent scanning of port 110 (TCP)

Typically seen on

nothing legitimately — dormant registration; any responsive 110/udp is an anomaly

Analyst note

The real POP3 surface is 110/tcp and 995/tcp; 110/udp is an unused IANA slot. Investigate a live 110/udp as a decoy, spoof, or misconfiguration, not a standard mail service.