Port 995 POP3S · TCP

What runs on port 995

POP3S: POP3 over implicit TLS. If you must offer POP3 at all, offer this one and close 110.

Software that uses it: Dovecot · Courier · Exchange

Should port 995 be open?

Designed to face the internet. This port exists to be reachable from anywhere, so the usual question is not whether to open it but how the service behind it is configured and patched.

• Most providers keep it only for very old clients and devices; IMAP on 993 is the default elsewhere.

Check port 995

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :995'
sudo lsof -i :995

# from another machine: is it reachable?
nc -zv host 995
nmap -p 995 host
curl -v telnet://host:995      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 995

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 995 proto tcp
sudo ufw deny 995/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 995 accept
nft add rule inet filter input tcp dport 995 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 995 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 995 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=995 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 995" with no source is just "open".

Related ports

• 110 POP3 — Mail retrieval, plaintext
• 993 IMAPS — IMAP over TLS
• 143 IMAP — Mail access, plaintext/STARTTLS

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions