POP3 mail retrieval over TLS, TCP 995.
POP3 servers listen on TCP 995 with TLS negotiated immediately on connect, the encrypted counterpart to cleartext POP3 on 110. RFC 8314 designates it the implicit-TLS access port for POP3. Clients connect, authenticate, download messages, and usually disconnect — POP3 has no server-side folder model, so this is a download-and-delete workflow rather than IMAP's sync. It turns up on scans of mail hosts that still support legacy or low-bandwidth clients.
Expose with care
Safe to expose in the sense that TLS is required, but it is a credential endpoint on a protocol most deployments no longer need — disable it if nothing uses POP3.
$ openssl s_client -connect MAIL_HOST:995 -quietSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.