Written by Ruben Selby, Founder and Lead Security Consultant, Wolfcore. Last reviewed 11 November 2026.

Part of the Wolfcore Resources library: Ports, protocols and services.

In one sentence: Port 995 is the door email programs use to download your mail over an encrypted connection, so if it is open to the internet, it is also a door someone can try to guess passwords against.

What runs on this port

Port 995 carries POP3S: the Post Office Protocol version 3, wrapped in TLS (the encryption that protects websites). The connection is encrypted from the first byte. The IETF standard RFC 8314 calls this “Implicit TLS” and names 995 as the default port for the pop3s service.

POP3 is built to download mail to one device. By default, POP3 clients remove downloaded messages from the server, and they rely on SMTP to send mail. The older alternative is port 110, where the client connects in plain text and may then ask to switch to encryption (STARTTLS). RFC 8314 prefers the always-encrypted port.

Why attackers look for it

Any service that answers on the internet can be found by scanning, and internet-wide scanning is routine. An open 995 tells an attacker a mail server is there and that mailbox logins can be tried. The prize is the mailbox itself: client conversations, password-reset emails for other services, and a trusted address to send fraud from.

How it gets attacked

• Password guessing. The login is a username and password. Attackers try common passwords across many accounts, or passwords leaked from other sites. Microsoft says that to protect an Exchange Online tenant from brute force or password spray attacks, you need to disable Basic authentication and use modern authentication only, which blocks legacy protocols such as POP and IMAP.
• The unencrypted sibling. The bigger risk is often port 110. RFC 8314 says that for any large community reading mail without encryption over the public internet, the compromise of at least some passwords should be assumed. A phone or scanner left on a plain setting sends its password readable.
• STARTTLS weaknesses. RFC 8314 points to CERT vulnerability note VU#555316, a STARTTLS command injection flaw that several implementers made independently, as a reason to prefer implicit TLS on 995.
• Old servers and certificate warnings. An unsupported mail server may have unpatched flaws, and staff who click through certificate warnings let someone in the middle read the login.

No single CVE defines port 995. The risk comes from the mail software behind it, so check that vendor’s advisories.

Who it affects and how badly

• Sole trader to 10 staff (estate agents, trades, small accountancies): cheap hosting often leaves POP3 and IMAP on. Worst case is one hijacked mailbox and a fraudulent invoice sent to a client.
• 10 to 50 staff (recruitment, schools, charities): old scanners and shared mailboxes keep legacy settings alive. A mailbox may hold candidate or pupil data, which brings UK GDPR duties.
• 50 to 250 staff, and regulated firms (legal, fintech, insurance, care providers in the UK, EU, US and Armenia): a mailbox breach can mean regulator and client notification and lost trust. The duty depends on the data inside, not the port.

Worked example for a small business (illustration only)

This is an invented example, not a real client. A 12-person letting agency keeps an older hosted mailbox for its lettings inbox. A branch scanner uses port 110 with no encryption because that was the easiest setting years ago. A password leaked from another site matches the mailbox. An attacker signs in, reads the inbox for a week, then emails tenants new bank details for rent. The cost is the diverted rent, staff time, apology calls and a possible ICO report if tenant data was exposed. The fix: move mail to a provider that requires modern sign-in with MFA, point the scanner at an encrypted method and close port 110.

How to check whether yours is exposed

1. List your firewall rules for inbound 995, 110, 993 and 143, with who asked for each and why.
2. Ask your IT provider or host which mail protocols your domain accepts, then check each phone, scanner and old PC that sends or reads mail.
3. In Microsoft 365, check POP3 and IMAP4 per user. Microsoft says they are enabled for all users in Exchange Online by default, and disabled when security defaults are on.
4. Scan only addresses you own, or have a tester do it with your written permission.

What we check on a test

• Which mail ports answer from the internet (25, 110, 143, 993, 995) and whether each one is needed.
• Whether the unencrypted ports accept a login before TLS, and which TLS versions and certificates are offered.
• Whether repeated logins are slowed, locked out or stopped by MFA.
• Whether the server software and version can be identified and is still supported.
• Whether your devices point at the safe port.

The UK angle

The NCSC’s Cyber Essentials requirements (v3.3, April 2026) give the firewall aim as making sure only secure and necessary network services can be accessed from the internet. Inbound rules must be approved and documented with the business need, and authentication to cloud services must always use MFA. An open mail port with no recorded reason, or a mailbox that signs in with a password alone, is the kind of thing an assessor will ask about.

How to secure it

1. Turn on MFA and disable Basic authentication for mailboxes, so a guessed password alone is not enough.
2. Close ports 110 and 143 to the internet unless a documented legacy system needs them. RFC 8314 says cleartext access should eventually be disabled or limited strictly to legacy systems that cannot be upgraded.
3. Prefer IMAP on 993 or a native Exchange connection where people use more than one device.
4. Require TLS 1.2 or later, which RFC 8314 says mail access servers must support.
5. Keep a valid server certificate, and tell staff never to click through a certificate warning.
6. Limit 995 to known source addresses where only an office or supplier connects.
7. Patch the mail server, or replace it if the vendor no longer supports it.
8. After moving to TLS, reset passwords that crossed the network in clear text, as RFC 8314 advises where old passwords were likely compromised.

Frequently asked questions

Is port 995 safe to leave open? It encrypts the connection, which is better than port 110. It still accepts logins from the internet, so it needs MFA or another guard against guessing, and should be open only if someone needs it.

What is the difference between port 995 and port 993? Port 995 is POP3 over TLS, which downloads mail to one device. Port 993 is IMAP over TLS, which keeps mail on the server so several devices see the same folders.

Does Microsoft 365 use port 995? Microsoft lists POP3 at Outlook.office365.com on port 995 with SSL/TLS for Exchange Online, but sign-in stops working when Basic authentication is disabled.

Related terms

port-110-pop3, port-993-imaps, port-143-imap, port-25-smtp, password-spraying, multi-factor-authentication

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.