366

Port 366/tcp is registered with IANA as odmr with the description "ODMR," assignee Randall Gellens (the sole author of RFC 2645), and a blank reference field — RFC 2645 is the defining specification but is not cited in the registry row — dual-registered on TCP and UDP. ODMR (On-Demand Mail Relay, RFC 2645, August 1999) is a restricted profile of ESMTP for authenticated on-demand mail pull, intended for intermittently-connected sites such as dial-up or dynamic-IP mail servers. The customer connects to the provider on port 366, issues EHLO and then AUTH (SASL), and then issues the ATRN (Authenticated TURN) command, optionally naming domains; after a 250 success, the client and server roles reverse and the provider becomes the SMTP client and pushes the customer's queued mail down the same connection. This improves on SMTP's insecure TURN and on ETRN: RFC 2645 requires that ATRN be rejected if the session has not been authenticated (using response code 530), mandates a timeout of at least ten minutes to allow the provider to process its mail queue, and releases mail only for domains the authenticated customer is authorized for (rejecting otherwise with a 450). The IANA reference field is blank. Security-wise, because ATRN requires prior authentication, ODMR is materially less abusable than ETRN, and RFC 2645's Security Considerations even suggest a TCP wrapper or firewall to restrict port 366 to the provider's network; it is obscure with a minimal footprint. For an analyst, an open 366 indicates an ODMR mail-pull server, typically at an ISP or hosting provider serving intermittently-connected customers, and is low-threat given the mandatory authentication.

IANA assignment

odmr — "ODMR"; reference (blank — RFC 2645 is the defining spec but is NOT cited in the IANA registry row); assignee Randall Gellens; dual-registered 366/tcp + 366/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.000715 (de-facto) [Well-established] — nmap-services file

Related ports

25 (SMTP), 587 (submission); ETRN mechanism on 25

Primary use

authenticated on-demand mail pull (ATRN) for intermittently-connected sites — RFC 2645

Other/unofficial uses

none beyond ODMR [Well-established]

Security implications

ATRN requires prior AUTH (less abusable than ETRN); RFC 2645 suggests firewalling 366 to the provider's network; obscure [Well-established]

Typically seen on

ODMR mail servers (ISP/hosting serving intermittently-connected customers)

Analyst note

An open 366 indicates an ODMR mail-pull server; low threat given mandatory authentication.

Port 366/udp is registered to ODMR (On-Demand Mail Relay), a legacy, largely obsolete mail-retrieval protocol; a modern host answering on this port is unusual rather than routine infrastructure, and it should not be assumed to face the public internet without investigation.

The IANA registry lists port 366 dual-registered on both TCP and UDP, assigned to Randall Gellens, with the Registration and Reference columns left blank in the CSV itself. RFC 2645 (August 1999), authored by Gellens and Newman, defines ODMR and explicitly reserves port 366 for it — the RFC's existence does not appear in IANA's own blank Reference field.

ODMR is an SMTP-restricted profile — using EHLO, AUTH, ATRN, and QUIT — that lets a mail host with a dynamically assigned address (dial-up era) authenticate to a relay and pull its queued mail, as an alternative to the static-IP-only ETRN mechanism. Real-world deployment was always limited, and the protocol saw little uptake outside a handful of late-1990s/early-2000s ISP mail systems.

Today ODMR is rarely encountered in production mail infrastructure. SANS Internet Storm Center shows only low-volume background scan traffic on port 366, with a "green" (minimal) threat rating, and no malware or botnet campaign specifically targeting it was found in the sources checked.

IANA assignment

odmr — "ODMR (On-Demand Mail Relay)"; reference (blank in registry); assignee Randall Gellens; dual-registered 366/tcp + 366/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Related ports

25/tcp (SMTP), 587/tcp (SMTP submission), 106/tcp (poppassd — historically clustered mail-management port)

Protocol-defining RFC

RFC 2645 (Gellens & Newman, August 1999) — defines ODMR (EHLO/AUTH/ATRN/QUIT) and explicitly reserves port 366; not cited in IANA's own Reference column

Primary use

on-demand mail-relay retrieval for dynamically-addressed (dial-up era) mail hosts; alternative to the static-IP-only ETRN mechanism

Malware association

none found in sources checked

Typically seen on

legacy/historical dial-up-era mail relay systems; otherwise rare and worth investigating [Likely]

Current adoption

largely obsolete; limited real-world deployment historically and rarely seen in modern mail infrastructure [Likely] — RFC 2645 context; no contradicting evidence found

Scan activity

SANS ISC shows only low-volume background scanning with a "green" (minimal) threat rating as of 2026-07-27 [Likely] — https://isc.sans.edu/port.html?port=366

Analyst note

no confirmed application sightings for 366/udp were found this pass (SpeedGuide.net returned 403, Wayback Machine unreachable); treat traffic on this port as ODMR by registry default and investigate further rather than assume malicious or benign.