PORTImplicit TLSIANA assigned
Port 995POP3 over TLS (POP3S)
Port 995 is the standard TCP port for POP3 over TLS (POP3S). It provides the same download-and-delete mail retrieval as port 110 but with the connection encrypted from the start. Use it whenever a POP3 account is required; otherwise prefer IMAP on port 993.
What port 995 is used for
Port 995 is POP3 inside a TLS session. The client connects, TLS is negotiated immediately, and only then does the POP3 conversation begin. It removes the main weakness of port 110, where credentials could be sent in clear text if STARTTLS was missing or skipped.
| Setting | Value |
|---|---|
| Server | pop.provider.example |
| Port | 995 |
| Security | SSL/TLS |
| Leave messages on server | Recommended if the mailbox is read elsewhere |
Security considerations
- Certificate validation must be enabled in the client.
- Download-and-delete is irreversible. A POP3 client that deletes server copies makes the local mail store the only copy; back it up.
- Server operators should offer 995 and either disable 110 or require STARTTLS on it.
How to check port 995
Is something listening locally? On Windows, open Command Prompt and run:
netstat -ano | findstr :995A line in the LISTENING state means a local program has bound port 995; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :995 or lsof -i :995.
Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:
Test-NetConnection pop.example.com -Port 995TcpTestSucceeded : True means the remote system accepted a TCP connection on port 995. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.
See the netstat and Test-NetConnection records for the full option sets.
Firewall considerations
Mail servers that offer POP3 need inbound 995. Nothing else does.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 995 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
Why would anyone still use POP3 on 995?
Some workflows want a local copy of mail and an empty server mailbox: archiving, small quotas, or scripts that pull mail into another system. For interactive use on several devices, IMAP is better.