209
Summary
- // if you see it open
- Plaintext like SMTP; rare in practice. The notable hardening note is applying the qmtpd-netstring.patch to protect qmail-qmtpd from buffer overflows on malformed netstring input.
- // analyst note
- An open 209/tcp suggests a qmail server with QMTP enabled (uncommon); otherwise likely a misidentified service.
About port 209/tcp.
Port 209/tcp is registered with IANA as qmtp with the description "The Quick Mail Transfer Protocol," assignee D. J. Bernstein, a modification date of 2018-04-05, and a blank reference field (dual-registered on TCP and UDP). QMTP is Daniel J. Bernstein's 8-bit-clean, pipelined, batched replacement for SMTP, part of the qmail ecosystem. Per DJB's specification (cr.yp.to/proto/qmtp.txt, dated 1997-02-01; also IETF draft draft-bernstein-qmtp-01), a QMTP-over-TCP server listens on port 209. The protocol's design goal is to eliminate SMTP's many round trips: a client sends a package consisting of the message plus the envelope sender and recipients — each netstring-encoded — and the server replies once per recipient, and it handles both DOS (CR-LF) and Unix (LF) line encodings without conversion. The qmail distribution ships the server qmail-qmtpd, while the client side lives in the serialmail package. The IANA reference field is blank. Security-wise the port is rare with a minimal footprint, and the protocol is plaintext like SMTP; the one notable hardening note from the qmail community is applying the qmtpd-netstring.patch to protect qmail-qmtpd from buffer overflows on malformed netstring input. For an analyst, an open 209/tcp suggests a qmail mail server with QMTP enabled, which is uncommon today and otherwise likely a misidentified service.
- IANA assignment
qmtp— "The Quick Mail Transfer Protocol"; reference (blank — no RFC cited in IANA registry); assignee D. J. Bernstein; modification date 2018-04-05; dual-registered 209/tcp + 209/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- rare; minimal open-frequency (de-facto) [Well-established] — nmap-services file
- Related ports
- 25/587 (SMTP/submission), 628 (qmqp — DJB's queue protocol)
Primary use
batched, pipelined SMTP alternative (qmail ecosystem)
Other/unofficial uses
none beyond qmail/serialmail [Well-established]
Security implications
plaintext like SMTP; rare; qmtpd-netstring.patch recommended to harden qmail-qmtpd against malformed-netstring overflow
Typically seen on
qmail mail servers with QMTP enabled
- Analyst note
- An open 209/tcp suggests a qmail server with QMTP enabled (uncommon); otherwise likely a misidentified service.
About port 209/udp.
Port 209/udp is registered with IANA as qmtp, "The Quick Mail Transfer Protocol," assignee and contact D. J. Bernstein, with a blank IANA registration date, a modification date of 2018-04-05, and a blank reference field — dual-registered alongside 209/tcp with identical fields. QMTP itself, as specified by Bernstein on 1997-02-01, is a TCP-native protocol: a QMTP server listens on port 209 and exchanges netstring-encoded envelope and message data over a stream connection to hand off mail more efficiently than SMTP. The original spec does not itself define a UDP transport mode, which makes the UDP side of this registration mostly a formal reservation riding alongside the TCP service rather than a documented independent protocol. Historically, nmap-services records port 209 (both tcp and udp) under the canonical name tam — Trivial Authenticated Mail Protocol — with qmtp listed as an alias, suggesting an earlier or competing registration before qmtp became IANA's primary current name for the port. QMTP saw adoption almost exclusively within the qmail mail-server ecosystem and related djb-derived tooling, and never spread meaningfully beyond that niche. Empirical prevalence is very low: nmap 7.70's open-frequency values put 209/tcp at roughly 0.0021 and 209/udp at roughly 0.0004, though that corpus dates to 2018 and no more recent authoritative scan telemetry (Shodan/Censys) was located for this port. A claim circulating on several low-quality port-database sites — that the UDP side is used for "lightweight notification or signaling messages" — could not be traced to any primary source and appears to be duplicated boilerplate rather than a documented fact, so it is recorded here as unverified rather than fact.
- IANA assignment
qmtp— "The Quick Mail Transfer Protocol"; assignee/contact D. J. Bernstein; registration date blank in registry; modification date 2018-04-05; reference field blank; dual-registered 209/tcp + 209/udp[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 505 (and line 504 for the tcp counterpart)- IANA RFC/reference
- none — QMTP is a self-published djb specification, not governed by any RFC, so the blank reference field is left blank rather than filled with an invented citation [Confirmed] — https://cr.yp.to/proto/qmtp.txt
- Range class
- well-known (0–1023)
- Prevalence
- nmap 7.70 open-frequency 209/tcp ≈ 0.002133, 209/udp ≈ 0.000395 (2018 corpus; no more recent authoritative scan data located) [Likely] — https://svn.nmap.org/nmap-releases/nmap-7.70/nmap-services
- Related ports
- 209/tcp (identical registry entry, TCP-native protocol home); other mail-transfer ports (25/tcp SMTP, 465/tcp SMTPS, 587/tcp submission)
Primary use (protocol design)
QMTP as specified (1997-02-01) is TCP-native — a server listens on port 209 and exchanges netstring-encoded mail envelopes/messages over a stream connection; the spec does not define a UDP transport mode
Other/unofficial uses
associated almost exclusively with the qmail mail-server ecosystem and djb-derived tools; no broader adoption documented
Security implications
no authoritative CVE or current scan-telemetry findings located for 209/udp specifically; generic "a trojan has used this port" boilerplate on some advisory-aggregator sites is repeated across many unrelated ports on those sites and is not treated as credible [Unknown]
Typically seen on
legacy/niche qmail deployments; open 209/udp is rare and not expected on typical modern hosts
- Historical naming
- nmap-services lists port 209 (tcp/udp) under canonical name
tam(Trivial Authenticated Mail Protocol), withqmtprecorded as an alias, indicating an earlier/alternate registration history beforeqmtpbecame IANA's current primary name[Confirmed] — https://svn.nmap.org/nmap-releases/nmap-7.70/nmap-services - UDP-specific usage claim
- a claim on several port-database sites (e.g. whatportis.com, tcp-udp-ports.com) that UDP is used for "lightweight notification or signaling messages" is unsourced content-farm boilerplate with no primary-source support; treated as unverified, not fact [Unknown] — no credible citation found
- Analyst note
- treat an open 209/udp as an anomaly worth investigating rather than an expected service; the UDP registration appears to be a formal reservation alongside the TCP-native protocol rather than an actively used independent UDP service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| tam | UDP | Trivial Authenticated Mail Protocol | 0.04% |
| tam | TCP | qmtp | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.