PORTUnencrypted unless STARTTLSIANA assigned
Port 110POP3
Port 110 is the standard TCP port for POP3 (Post Office Protocol version 3), which downloads messages from a mail server to a single client. Traffic on 110 is unencrypted unless STARTTLS is used; modern clients should use port 995 (POP3 over TLS) or switch to IMAP.
What port 110 is used for
POP3 is the older of the two mail retrieval protocols. A client connects to port 110, authenticates, lists messages, downloads them and usually deletes them from the server. The model suited dial-up connections and single computers; it does not suit a world where the same mailbox is read on several devices.
Port 110 survives on many hosting platforms because it is cheap to offer and some legacy clients still expect it.
Encryption
RFC 2595 added STARTTLS to POP3, so a session on 110 can be encrypted after the initial handshake. In practice, clients and providers moved to implicit TLS on port 995. RFC 8314 recommends the implicit-TLS ports for all mail access. If a provider only offers 110 without STARTTLS, treat the account credentials as exposed to the network.
Security considerations
- Prefer 995 or IMAPS on 993. Configure clients with "SSL/TLS" security.
- Disable plain 110 on servers where no client needs it, or require STARTTLS before authentication.
- POP3 downloads are a data-loss hazard. With delete-after-download, a lost device means lost mail. Enable "leave a copy on the server" if POP3 must be used.
How to check port 110
Is something listening locally? On Windows, open Command Prompt and run:
netstat -ano | findstr :110A line in the LISTENING state means a local program has bound port 110; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :110 or lsof -i :110.
Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:
Test-NetConnection mail.example.com -Port 110TcpTestSucceeded : True means the remote system accepted a TCP connection on port 110. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.
See the netstat and Test-NetConnection records for the full option sets.
Firewall considerations
Only mail servers that still offer plain POP3 need inbound 110. Consider closing it and offering 995 only.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 110 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
POP3 or IMAP?
IMAP keeps mail on the server and synchronises state across devices. POP3 downloads to one device and, by default, deletes the server copy. For anyone with a phone and a computer, IMAP is the practical choice.
Is port 110 safe to use?
Only if the client negotiates STARTTLS and requires it. Without TLS the password and every message travel in clear text. Port 995 avoids the question by encrypting from the start.