In one sentence: Port 110 is the door that older email programs use to download messages from a mail server, and its plain version sends the password unprotected.

What runs on this port

POP3, the Post Office Protocol version 3, lets a mail program collect messages from a server. RFC 1939 states that the server starts the service by listening on TCP port 110. A person authenticates with the USER and PASS commands.

It is an older design, and most current mail setups use IMAP or a managed service instead.

The secure version is POP3 over TLS on port 995. The IANA registry points port 995 at RFC 8314, which is titled “Cleartext Considered Obsolete” and recommends TLS for mail access.

Why attackers look for it

A mail login that faces the internet can be guessed at, day and night. Mail accounts are valuable because they receive password reset links for other services.

Older protocols are also a gap in your defences. Microsoft explains that enforcing multi-factor authentication is not simple or in some cases possible when Basic authentication stays enabled, and that Basic authentication makes it easier for attackers to capture credentials, particularly where they are not protected by TLS.

How it gets attacked

• Password guessing and spraying. Attackers try common passwords against many accounts.
• Captured credentials. On the plain port 110, a person watching the network path can capture the login. Microsoft makes this point about Basic authentication.
• MFA gap. Legacy mail protocols cannot always prompt for a second factor.
• Server flaws. CVE-2019-11500: the National Vulnerability Database (NVD) records that Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 could suffer out-of-bounds writes and remote code execution because of mishandled null characters in quoted strings. It is scored 9.8 on CVSS v3.0.

Who it affects and how badly

• Sole trader to 10 staff: a mailbox on a small web host using POP3. Worst case: a guessed password hands over every message and password reset.
• 10 to 50 staff: firms with old scanners and apps that need POP3.
• 50 to 250 staff: recruitment and legal firms where one mailbox holds contracts and personal data.
• Regulated businesses: mailbox compromise can mean a reportable personal data breach.

How to check whether yours is exposed

• Read firewall rules for inbound TCP 110 and 995.
• Ask your mail provider or MSP whether POP3 is enabled, and for which mailboxes.
• In Microsoft 365, remember Basic authentication has been removed for POP in Exchange Online. Check any apps that stopped connecting.
• Review sign-in logs for failed logins from unfamiliar places.
• Run the free web vulnerability scan and review the results for your own addresses.

How to secure it

1. Turn POP3 off for any mailbox that does not need it.
2. Where you must keep it, use the TLS version on port 995 (RFC 8314).
3. Block inbound port 110 at the firewall.
4. Use modern authentication with MFA instead of Basic authentication.
5. Use long, unique passwords and a lockout or throttle policy.
6. Keep mail server software updated, particularly Dovecot-style servers.
7. Move devices and apps that insist on POP3 to a supported method.
8. Review who still has POP3 enabled every year.

Related terms

• port 143 imap
• port 25 smtp
• password spraying
• brute force attack
• multi factor authentication
• microsoft 365 security basics

Frequently asked questions

What port does POP3 use?
TCP port 110 for the standard service (RFC 1939), and port 995 for POP3 over TLS.

Is POP3 on port 110 encrypted?
Not by itself. RFC 8314 is titled Cleartext Considered Obsolete and recommends TLS for mail access.

Does Microsoft 365 still allow POP with a password?
Microsoft says it removed Basic authentication for POP in Exchange Online, so apps must use modern authentication.

Sources

• RFC 1939, Post Office Protocol Version 3: https://www.rfc-editor.org/rfc/rfc1939.txt
• RFC 8314, Cleartext Considered Obsolete: https://www.rfc-editor.org/rfc/rfc8314.txt
• Microsoft Learn, Basic authentication deprecation in Exchange Online: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online
• NVD record for CVE-2019-11500 (Dovecot): https://nvd.nist.gov/vuln/detail/CVE-2019-11500
• IANA service name and port number registry: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.