DevToolsmith

Port 995: POP3S

Port 995 (TCP) is used by POP3 over TLS for securely downloading email. It is a well-known port (0–1023). On Linux and macOS, binding to it needs root or the CAP_NET_BIND_SERVICE capability.

Service
POP3S
Protocol
TCP
Range
Well-known (0–1023)
Official
IANA-registered
Exposure
Meant to be public
Category
Email

What uses port 995

POP3S is POP3 wrapped in TLS. Use it instead of port 110 when a client or integration only supports POP, for example ticketing systems that collect mail from a mailbox. IMAP (993) is usually the better option for people reading mail on several devices.

Should port 995 be open to the internet?

Meant to be public. This port is meant to be reachable by clients on the internet when you run this service publicly.

Check what is listening on port 995

Linux
sudo ss -ltnp 'sport = :995'
macOS
sudo lsof -nP -iTCP:995 -sTCP:LISTEN
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 995 -State Listen
netstat -ano | findstr :995

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 995

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

macOS / Linux
sudo kill $(sudo lsof -t -iTCP:995 -sTCP:LISTEN)
Windows (PowerShell)
Stop-Process -Id (Get-NetTCPConnection -LocalPort 995 -State Listen).OwningProcess

Open port 995 in the firewall

Ubuntu / Debian (ufw)
sudo ufw allow 995/tcp
# Close it again:
sudo ufw delete allow 995/tcp
RHEL / Fedora / Rocky (firewalld)
sudo firewall-cmd --permanent --add-port=995/tcp
sudo firewall-cmd --reload
Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "POP3S 995/TCP" -Direction Inbound -Protocol TCP -LocalPort 995 -Action Allow

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 995 from another machine

macOS / Linux
nc -zv example.com 995
Windows (PowerShell)
Test-NetConnection example.com -Port 995

Related ports

  • Port 110 (POP3): used by POP3 for downloading email from a mail server.
  • Port 993 (IMAPS): used by IMAP over TLS for securely reading email.
  • Port 143 (IMAP): used by IMAP for reading email that stays on the server.

More email ports

25 (SMTP) , 465 (SMTPS) , 587 (SMTP submission) . See all ports in the port lookup.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 995 used for?

Port 995 is used by POP3 over TLS for securely downloading email. POP3S is POP3 wrapped in TLS. Use it instead of port 110 when a client or integration only supports POP, for example ticketing systems that collect mail from a mailbox. IMAP (993) is usually the better option for people reading mail on several devices.

Is it safe to open port 995?

This port is meant to be reachable by clients on the internet when you run this service publicly. Keep the service behind it up to date and require authentication where it applies.

How do I check if port 995 is open?

On the server, list listening sockets with "sudo ss -ltnp 'sport = :995'" on Linux or "sudo lsof -nP -i :995" on macOS. From another machine, run "nc -zv host 995" or, on Windows, "Test-NetConnection host -Port 995". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.