Port 995 — POP3S

Q: How do I check if port 995 is open?

Locally, sudo lsof -i :995 on macOS or Linux, or netstat -ano | findstr :995 on Windows. From outside, nc -zv host 995 tells you whether anything answers.

TCP well-known

What runs on port 995

POP3 over TLS.

POP3 over TLS. The encryption is the only thing this shares with 993 — the protocol underneath is fundamentally different. POP3 downloads and typically deletes, keeping no server-side state, so a second device sees an empty mailbox. IMAP on 993 synchronises instead. Choosing 995 over 993 is a decision about how mail is stored, not about security, and it is almost always the wrong one for anyone with more than one device.

Security considerations

Use this rather than 110, though IMAP is a better protocol for most people.

Checking whether something is listening

# Linux / macOS — what is bound to the port
sudo lsof -i :995
sudo ss -lntp | grep :995

# Windows
netstat -ano | findstr :995
Get-NetTCPConnection -LocalPort 995

# is it reachable from outside?
nc -zv example.com 995
curl -v telnet://example.com:995

Freeing the port

# find the process, then stop it
sudo lsof -ti :995 | xargs kill        # Linux / macOS
netstat -ano | findstr :995            # note the PID, then:
taskkill /PID <pid> /F                    # Windows

Should this port be open to the internet?

Only on a mail server. If this port is open on something that is not intentionally handling mail, you may be running an open relay — which will get the IP blacklisted quickly.

Opening or blocking port 995

Finding the port is usually the first half of the job. Start narrow — the second rule is there for services that genuinely serve the public, and most do not:

# ufw — Debian, Ubuntu
sudo ufw allow from 10.0.0.0/8 to any port 995 proto tcp
sudo ufw allow 995/tcp                   # only if it genuinely serves the public

# firewalld — RHEL, Fedora, CentOS
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=995 protocol=tcp accept'
sudo firewall-cmd --reload

# iptables, if you are still there
sudo iptables -A INPUT -p tcp --dport 995 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 995 -j DROP

# Windows
New-NetFirewallRule -DisplayName "POP3S 995" -Direction Inbound -Protocol TCP -LocalPort 995 -RemoteAddress 10.0.0.0/8 -Action Allow

10.0.0.0/8 stands in for a private range — substitute your own. Note that a firewall rule does not undo a service bound to 0.0.0.0; it only stops packets reaching it, and a misconfigured or disabled firewall then exposes it immediately.

Quick reference

Port	995
Protocol	TCP
Service	POP3S
Range	Well-known (0–1023) — binding requires root on Unix

Frequently asked questions

What is port 995 used for?

POP3 over TLS.

Is it safe to open port 995?

Use this rather than 110, though IMAP is a better protocol for most people.

How do I check if port 995 is open?

Locally, sudo lsof -i :995 on macOS or Linux, or netstat -ano | findstr :995 on Windows. From outside, nc -zv host 995 tells you whether anything answers.

Why do I get "address already in use" on port 995?

Another process is bound to it — often a previous run of your own program that did not exit cleanly. Find it with lsof -ti :995 and stop it, or configure your application to use a different port.

Can I change the port this service uses?

Almost always yes, in the service's configuration. Moving off a default port reduces automated scan noise, but it is obfuscation rather than security — a real attacker scans all 65,535.

Other common ports

All port numbers