{
  "port": 110,
  "protocol": "tcp",
  "service": "POP3",
  "oneLiner": "POP3 — download-and-usually-delete mail retrieval, with no server-side folder state.",
  "whatItIs": "A client connects, authenticates with USER/PASS or APOP, lists messages by number, retrieves them with RETR, and typically marks them deleted; the mailbox is a flat list with no folders and no cross-device sync. Port 110 is the cleartext port, upgraded in practice with STLS or replaced by implicit-TLS POP3S on 995. It is still served by Dovecot and by most hosting providers for legacy clients and scripted fetchers. Its appearance on a scan usually means an old mail host or a shared-hosting control panel.",
  "exposure": {
    "verdict": "careful",
    "note": "Only expose 110 when the server requires STLS before accepting credentials; otherwise use POP3S on 995."
  },
  "checkCommand": "printf 'CAPA\\r\\nQUIT\\r\\n' | nc -v MAIL_HOST 110",
  "links": [
    {
      "title": "RFC 1939 — Post Office Protocol Version 3",
      "url": "https://www.rfc-editor.org/rfc/rfc1939.html",
      "kind": "spec"
    },
    {
      "title": "Dovecot (IMAP/POP3 server) source repository",
      "url": "https://github.com/dovecot/core",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}