995
Summary
- // if you see it open
- Removes stripping risk; still subject to credential brute-force/stuffing where basic auth is allowed. OAuth and app-passwords are the modern controls; POP is third (behind SMTP and IMAP) among password-spray-targeted protocols per Microsoft.
- // common applications
- DovecotCourierMicrosoft Exchange
- // analyst note
- Open 995/tcp indicates a secure POP3 server. Validate the certificate, require TLS 1.2+, and check whether legacy auth is disabled.
About port 995/tcp.
Port 995/tcp is POP3 over implicit TLS — the TLS handshake completes on connect, then the POP3 exchange proceeds in its AUTHORIZATION phase already encrypted. The POP3 semantics match port 110 (download-and-optionally-delete retrieval to a single client), but encrypting from the first byte removes the cleartext negotiation window that the STLS upgrade on 110 leaves open. RFC 8314 designates implicit TLS as the preferred secure model for POP3 access, and the IANA registry reflects this: the pop3s entry is described as "POP3 over TLS protocol," assigned to the IESG, registered 2017-12-12, and references RFC 8314. With the transport secured, the residual risk is credential brute-force and credential-stuffing where basic authentication is permitted; OAuth and app-passwords are the modern controls, and POP ranks third (behind SMTP and IMAP) among protocols targeted by password-spray campaigns per Microsoft. For an analyst, an open 995/tcp indicates a secure POP3 server; validate the certificate, require TLS ≥1.2, and check whether legacy authentication is disabled. Major providers such as Gmail and Microsoft 365 still offer POP3S while steering users toward IMAP for multi-device use.
- IANA assignment
pop3s— "POP3 over TLS protocol"; reference [RFC8314]; assignee IESG/IETF Chair; registered 2017-12-12. (995/udp historicallypop3s"pop3 protocol over TLS/SSL (was spop3)", contact Gordon Mangione) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 0.029921 [Well-established] — nmap-services file
- Related ports
- 110 (POP3 cleartext/STLS); parallels 993 and 465; SRV label
_pop3s._tcp(RFC 6186)
Primary use
POP3 mail retrieval over implicit TLS; RFC 8314-preferred secure POP3
Other/unofficial uses
none notable beyond POP3S itself [n/a]
Security implications
removes stripping risk; still subject to credential brute-force/stuffing where basic auth is allowed; POP is third among password-spray-targeted protocols (Microsoft). OAuth/app-passwords are the modern controls
Typically seen on
POP3 mailbox servers and cloud mail platforms (Gmail and Microsoft 365 offer POP3S while steering to IMAP)
- Analyst note
- Open 995/tcp indicates a secure POP3 server. Validate the certificate, require TLS 1.2+, and check whether legacy auth is disabled.
About port 995/udp.
Port 995/udp is registered with IANA under the service name pop3s with the description "pop3 protocol over TLS/SSL (was spop3)," assignee Gordon Mangione, and a blank reference field. The same number is dual-registered on TCP, where the description reads "POP3 over TLS protocol," the assignee is the IESG/IETF Chair, the reference is RFC 8314, and the registry shows a 2017-12-12 modification date — but the UDP row carries no RFC reference and no registration or modification date. That asymmetry is the whole story: POP3S is a session-oriented mail-retrieval protocol that requires reliable, ordered delivery, so it runs exclusively over TCP in every real-world deployment (Outlook, Thunderbird, Apple Mail, Exchange all bind TCP/995 only). The UDP assignment is a legacy artifact of IANA's historical practice of dual-allocating a TCP and UDP number together even when only one transport was requested, and there is no known software that listens on UDP/995. For an analyst the practical security surface is essentially nil: no listener answers, so internet-wide scanners (Shodan included) enumerate no meaningful banner on UDP/995, generic UDP probes draw an ICMP port-unreachable from hosts with no listener or silence from filtered ones, and no CVE or malware family is documented against the UDP variant specifically. A stateless firewall that mirrors its TCP/995 rule onto UDP may leave UDP/995 nominally "open," but nothing would respond. Treat a UDP/995 finding as noise or misconfiguration rather than a real service; all genuine POP3S activity, and all relevant tooling (nmap, pentest enumeration), targets the TCP side.
- IANA assignment
pop3s— "pop3 protocol over TLS/SSL (was spop3)"; reference (blank — no RFC cited for the UDP row); assignee Gordon Mangione; dual-registered 995/tcp + 995/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, line 1648)- Range class
- well-known (0–1023)
- Prevalence (UDP)
- negligible — no software legitimately binds UDP/995, so scanners enumerate no meaningful banner; UDP probes draw ICMP port-unreachable or silence [Likely] — Shodan ports listing, AuditMyPC UDP/995
- Registration/modification dates (UDP)
- Unknown — blank in the IANA registry for the UDP row [Confirmed] — IANA registry
- Related ports
- 995/tcp (the real POP3S transport); the secure-mail cluster 993/tcp (IMAPS), 465/tcp (SMTPS submission)
Primary use
none in practice on UDP — POP3S is session-oriented and runs only over TCP; the UDP entry mirrors the TCP pop3s assignment and has no real-world binding
Common software (UDP)
none known; all POP3S clients/servers (Outlook, Thunderbird, Apple Mail, Exchange) bind TCP/995 only
Security implications
essentially zero practical surface; no documented CVE or malware tied to UDP/995; stateless firewalls may mirror the TCP/995 rule onto UDP, leaving it nominally open with no responder; pentest tooling (nmap) enumerates port 995 only on the TCP side
Typically seen on
nothing legitimately; a UDP/995 hit is noise, a mirrored firewall rule, or misconfiguration
- TCP counterpart
- 995/tcp — "POP3 over TLS protocol," assignee [IESG]/[IETF_Chair], reference [RFC8314], modification date 2017-12-12 [Confirmed] — IANA registry (line 1647)
- Analyst note
- Treat UDP/995 as effectively unused. Genuine POP3S is TCP-only; investigate a responding UDP/995 listener as anomalous (covert channel or misconfiguration) rather than a normal mail service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| pop3s | TCP | POP3 protocol over TLS/SSL | 2.99% |
| pop3s | UDP | pop3 protocol over TLS/SSL (was spop3) | 0.10% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.