{
  "port": 995,
  "protocol": "tcp",
  "service": "POP3S (POP3 over implicit TLS)",
  "oneLiner": "POP3 mail retrieval over TLS, TCP 995.",
  "whatItIs": "POP3 servers listen on TCP 995 with TLS negotiated immediately on connect, the encrypted counterpart to cleartext POP3 on 110. RFC 8314 designates it the implicit-TLS access port for POP3. Clients connect, authenticate, download messages, and usually disconnect — POP3 has no server-side folder model, so this is a download-and-delete workflow rather than IMAP's sync. It turns up on scans of mail hosts that still support legacy or low-bandwidth clients.",
  "exposure": {
    "verdict": "careful",
    "note": "Safe to expose in the sense that TLS is required, but it is a credential endpoint on a protocol most deployments no longer need — disable it if nothing uses POP3."
  },
  "checkCommand": "openssl s_client -connect MAIL_HOST:995 -quiet",
  "links": [
    {
      "title": "RFC 1939 — Post Office Protocol Version 3",
      "url": "https://www.rfc-editor.org/rfc/rfc1939.html",
      "kind": "spec"
    },
    {
      "title": "RFC 8314 — TLS for Email Submission and Access",
      "url": "https://datatracker.ietf.org/doc/html/rfc8314",
      "kind": "spec"
    },
    {
      "title": "Dovecot (GitHub)",
      "url": "https://github.com/dovecot/core",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}