Port 995 — POP3S
TCP well-known
What runs on port 995
POP3 over TLS.
Security considerations
Use this rather than 110, though IMAP is a better protocol for most people.
Checking whether something is listening
# Linux / macOS — what is bound to the port
sudo lsof -i :995
sudo ss -lntp | grep :995
# Windows
netstat -ano | findstr :995
Get-NetTCPConnection -LocalPort 995
# is it reachable from outside?
nc -zv example.com 995
curl -v telnet://example.com:995
Freeing the port
# find the process, then stop it
sudo lsof -ti :995 | xargs kill # Linux / macOS
netstat -ano | findstr :995 # note the PID, then:
taskkill /PID <pid> /F # Windows
Should this port be open to the internet?
Only on a mail server. If this port is open on something that is not intentionally handling mail, you may be running an open relay — which will get the IP blacklisted quickly.
Quick reference
| Port | 995 |
| Protocol | TCP |
| Service | POP3S |
| Range | Well-known (0–1023) — binding requires root on Unix |
Frequently asked questions
What is port 995 used for?
POP3 over TLS.
Is it safe to open port 995?
Use this rather than 110, though IMAP is a better protocol for most people.
How do I check if port 995 is open?
Locally, sudo lsof -i :995 on macOS or Linux, or netstat -ano | findstr :995 on Windows. From outside, nc -zv host 995 tells you whether anything answers.
Why do I get "address already in use" on port 995?
Another process is bound to it — often a previous run of your own program that did not exit cleanly. Find it with lsof -ti :995 and stop it, or configure your application to use a different port.
Can I change the port this service uses?
Almost always yes, in the service's configuration. Moving off a default port reduces automated scan noise, but it is obfuscation rather than security — a real attacker scans all 65,535.