TCP Port 110 – POP3 (Post Office Protocol version 3)
Port 110 is the standard port for POP3, the Post Office Protocol version 3. POP3 is one of the two original protocols mail clients use to retrieve messages from a mail server, the other being IMAP. POP3 was designed for a simpler era of email: connect to the server, download all new messages, optionally delete them from the server, and disconnect. The protocol has been in use since the late 1980s and is specified in RFC 1939, published in 1996.
POP3 on port 110 is the unencrypted variant. Modern email clients almost always use POP3S on port 995 instead, which wraps the same protocol in a TLS encrypted session. Where port 110 is still used, it is most often within an internal network or behind a VPN, not directly across the public internet.
The download-and-delete model that POP3 was built around fits poorly with modern email use. Most users now expect to access the same inbox from a phone, a laptop, and a web browser, with messages staying synchronized across devices. IMAP, on port 143 or its encrypted counterpart on port 993, was designed for that pattern and has largely displaced POP3 for new deployments. POP3 remains supported by most mail providers for compatibility with older clients and for users who specifically want messages pulled off the server onto a single device.
Port 110 is also defined for UDP in the IANA registry, but UDP/110 is not used in practice. POP3 requires the reliable, ordered delivery that TCP provides.
About TCP Port 110
Port 110 carries the IANA assignment for pop3. The IANA description reads: ‘Post Office Protocol – Version 3’.
Security Considerations
POP3 on port 110 transmits credentials and message contents in plaintext by default. A user logging in over port 110 sends their password unencrypted across the network, where any device on the path can read it. STLS, an extension that upgrades a port 110 session to TLS after connecting, exists but is inconsistently supported by both clients and servers. The reliable solution is to use POP3S on port 995 instead, which encrypts the entire session from the start.
The IDS rule activity tied to port 110 reflects a long history of server-side vulnerabilities. Our data shows 50 rules referencing this port, dominated by the attempted-admin and misc-activity classtypes. The sample rules target buffer overflow attacks against legacy POP3 server implementations, including the qpopper server, APOP authentication handling, and the USER and PASS commands themselves. Most of these flaws were discovered and patched in the late 1990s and early 2000s, but the rules remain useful for detecting attacks against unpatched legacy systems.
Common practice today is to disable POP3 on port 110 entirely on internet-facing mail servers, offering only POP3S on port 995 and IMAPS on port 993 to clients. Organizations that must support port 110 for compatibility typically restrict it to internal network ranges or require client connections to upgrade to TLS via STLS.
Port 110 traffic across the public internet, particularly to or from a host that is not a known mail server, is uncommon in modern environments. Inbound POP3 to a workstation that does not run a mail server suggests either misconfiguration or an active probe.
IDS Rule References
50 IDS / security rules reference TCP port 110. Treat that number as context, not a danger score. Many detection rules are written against groups of ports rather than one service, web ports especially, so common web alternate ports inherit large counts while genuinely sensitive services can show few rules or none. Presence in IDS rules does not mean traffic on this port is malicious.
Rule categories (top 6): misc-activity (22), attempted-admin (19), bad-unknown (3), trojan-activity (3), misc-attack (2), suspicious-login (1).
Sample rule descriptions for TCP port 110:
- PROTOCOL-POP EXPLOIT x86 BSD overflow
- PROTOCOL-POP EXPLOIT x86 BSD overflow
- PROTOCOL-POP EXPLOIT x86 Linux overflow
- PROTOCOL-POP EXPLOIT x86 SCO overflow
- PROTOCOL-POP EXPLOIT qpopper overflow
Malware Rule References
A small share of the IDS rules that reference this port are malware related.
3 of the 50 IDS rules that reference TCP port 110 are malware related. That describes detection coverage across the whole internet, not anything about your machine or your network.
Families observed (top 1): UTF-8 (1).
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).