{
  "port": 1352,
  "protocol": "tcp",
  "service": "Lotus Notes / HCL Domino NRPC",
  "oneLiner": "NRPC — the protocol Notes clients and Domino servers use for mail, databases, directory and replication.",
  "whatItIs": "Notes Remote Procedure Call (NRPC) is the foundation of communication between Notes workstations and Domino servers and between Domino servers themselves, and by default every NRPC connection uses TCP 1352. It carries database access, directory lookups, mail routing and server-to-server replication in one proprietary protocol. Because IANA assigned the port to Domino, little else competes for it, so 1352 open is a reliable indicator of a Domino server. Domino's Internet services (HTTP, SMTP, IMAP) run on their own ports, not this one.",
  "exposure": {
    "verdict": "careful",
    "note": "Internet-facing 1352 is normal for cross-organisation Domino replication, but it is an authenticated application port on a large legacy codebase — restrict it to known partner networks and enable port encryption rather than leaving it open to the world."
  },
  "checkCommand": "nmap -Pn -p 1352 -sV TARGET",
  "links": [
    {
      "title": "HCL Domino documentation — Changing a TCP or TLS port number (\"all NRPC connections use TCP port 1352\")",
      "url": "https://help.hcl-software.com/domino/14.0.0/admin/conf_changingatcporsslportnumber_t.html",
      "kind": "official-docs"
    },
    {
      "title": "HCL Domino documentation — NRPC communication",
      "url": "https://help.hcl-software.com/domino/12.0.0/admin/conf_nrpccommunication_c.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}