Toolman

Port 995 — POP3S

TCP well-known

What runs on port 995

POP3 over TLS.

Security considerations

Use this rather than 110, though IMAP is a better protocol for most people.

Checking whether something is listening

# Linux / macOS — what is bound to the port
sudo lsof -i :995
sudo ss -lntp | grep :995

# Windows
netstat -ano | findstr :995
Get-NetTCPConnection -LocalPort 995

# is it reachable from outside?
nc -zv example.com 995
curl -v telnet://example.com:995

Freeing the port

# find the process, then stop it
sudo lsof -ti :995 | xargs kill        # Linux / macOS
netstat -ano | findstr :995            # note the PID, then:
taskkill /PID <pid> /F                    # Windows

Should this port be open to the internet?

Only on a mail server. If this port is open on something that is not intentionally handling mail, you may be running an open relay — which will get the IP blacklisted quickly.

Quick reference

Port995
ProtocolTCP
ServicePOP3S
RangeWell-known (0–1023) — binding requires root on Unix

Frequently asked questions

What is port 995 used for?

POP3 over TLS.

Is it safe to open port 995?

Use this rather than 110, though IMAP is a better protocol for most people.

How do I check if port 995 is open?

Locally, sudo lsof -i :995 on macOS or Linux, or netstat -ano | findstr :995 on Windows. From outside, nc -zv host 995 tells you whether anything answers.

Why do I get "address already in use" on port 995?

Another process is bound to it — often a previous run of your own program that did not exit cleanly. Find it with lsof -ti :995 and stop it, or configure your application to use a different port.

Can I change the port this service uses?

Almost always yes, in the service's configuration. Moving off a default port reduces automated scan noise, but it is obfuscation rather than security — a real attacker scans all 65,535.

Other common ports

All port numbers