Port 110 POP3 · TCP

What runs on port 110

POP3: download-and-delete mail retrieval, plaintext by default with an optional STLS upgrade. It is largely replaced by IMAP for anything with more than one device, and by POP3S (995) when POP3 itself is still wanted. Expose 995 and keep 110 closed, or allow it only with STLS required.

Software that uses it: Dovecot · Courier · Cyrus · Exchange

Should port 110 be open?

Disable it. This is a legacy or insecure protocol. The recommendation is not to firewall it but to turn the service off and use the modern replacement.

• Clients still configured for 110 without TLS send the password in the clear; check with a capture before assuming.

Check port 110

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :110'
sudo lsof -i :110

# from another machine: is it reachable?
nc -zv host 110
nmap -p 110 host
curl -v telnet://host:110      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 110

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 110 proto tcp
sudo ufw deny 110/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 110 accept
nft add rule inet filter input tcp dport 110 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 110 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 110 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=110 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 110" with no source is just "open".

Related ports

• 995 POP3S — POP3 over TLS
• 143 IMAP — Mail access, plaintext/STARTTLS
• 993 IMAPS — IMAP over TLS
• 25 SMTP — Mail transfer between servers

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions