Port 110 is the default TCP port for POP3, the protocol used to retrieve email from a server. If it is left unencrypted, usernames and passwords can be intercepted, so defenders should prefer protected configurations, restrict exposure, and monitor for legacy clients that still rely on clear text access.
What Port 110 Represents in Email Retrieval
Port 110 is the default access point for POP3 traffic, so it is more than a number on a firewall rule. It defines where clients reach the mailbox retrieval service, which makes it part of the trust boundary for authentication, session setup, and network exposure.
Because POP3 was designed for simple mail retrieval, the security posture of port 110 depends heavily on whether the deployment allows clear text use, enforces protected transport, or has been retired in favour of safer mail access patterns. In practice, teams should treat the port as a service exposure decision rather than a neutral plumbing detail.
Why Unencrypted POP3 on Port 110 Is Dangerous
When POP3 runs without transport protection, usernames and passwords can be exposed to passive interception, especially on shared networks, misrouted traffic paths, or any environment where monitoring is not tightly controlled. The issue is not theoretical: the protocol can reveal credentials before the mailbox is even opened.
That creates a straightforward confidentiality failure and can also become an initial access path if reused passwords are captured and tried elsewhere. Network Ports and Protocols Security Guide places POP3 alongside other legacy services that should be restricted or replaced when they can be reached in the clear.
Attackers do not need to defeat the mailbox server itself if the session can be observed in transit. A weakly protected POP3 deployment therefore exposes both the account and any downstream systems that trust the same credentials.
How Organisations Should Assess Exposure
Exposure checking starts with an asset inventory: identify which mail clients, servers, relay paths, and external networks still depend on POP3, and confirm whether those flows traverse port 110 at all. Legacy support often persists because one old client, script, or embedded system still relies on it.
Next, validate whether the service is reachable from untrusted networks, whether firewall rules still permit inbound access, and whether modern clients can be moved to encrypted alternatives. The port itself is registered by IANA, but local exposure is what determines actual risk.
Organisations should also review vendor guidance and platform defaults, because some mail stacks keep older retrieval modes enabled for compatibility. That compatibility can quietly preserve a clear-text path long after the business believes it has moved on.
Protection, Detection, and Recovery Considerations
The strongest control is to avoid clear-text POP3 use where possible and prefer protected configurations that encrypt the session before credentials are disclosed. Where POP3 must remain available, exposure should be limited to the smallest possible set of hosts, users, and network paths.
Detection should focus on signs of legacy behaviour: repeated connections to port 110, client populations that fail to negotiate protection, and authentication patterns that indicate older mail software. NCSC UK Advice and Guidance is a useful starting point for broader remote-access hardening and operational monitoring practices.
If clear-text POP3 has been exposed, response should include credential review, password reset where appropriate, and investigation for abnormal mailbox activity. In cases where the same password may have been reused elsewhere, the compromise can extend beyond email retrieval into adjacent systems.
Risk and Threat Considerations
Port 110 is risky because it can expose mailbox credentials in transit, turning a routine mail-check operation into a credential interception opportunity. The same weakness also creates a low-friction path for attackers who want to reuse stolen passwords against other services.
Failure mechanism: clear-text POP3 sessions allow passive capture of usernames and passwords, especially when clients still depend on legacy mail access or when network paths are insufficiently protected.
Impact: account compromise can lead to mailbox access, message theft, password reuse attacks, and broader exposure if the same credentials unlock other internal or cloud services.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-13 — Data Protection | Port 110 exposure can disclose credentials in transit and needs protected transport. |
| Recommendation — Encrypt mail retrieval traffic and limit clear-text POP3 exposure to reduce credential interception risk. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | POP3 on port 110 can reveal reusable login credentials that must be protected and rotated. |
| SC-8 — Transmission Confidentiality and Integrity | The subject is the security of credentials and data moving over a network port. | |
| Recommendation — Protect and rotate credentials used for mailbox retrieval when clear-text exposure is possible. Require encrypted transport for POP3 sessions so credentials are not exposed on the wire. | ||
| ISO/IEC 27001:2022 | A.8.24 — Use of cryptography | Encrypted transport is the primary control for preventing clear-text POP3 interception. |
| Recommendation — Apply encrypted transport controls to mailbox retrieval traffic that would otherwise traverse port 110. | ||
| NIST CSF 2.0 | PR.DS-02 — Data-in-Transit is Protected | POP3 over port 110 directly concerns protecting data and credentials in transit. |
| Recommendation — Protect data in transit for POP3 connections and phase out unencrypted retrieval paths. | ||
Practitioner Guidance
Why practitioners should care: Port 110 should be treated as a compatibility exception, not a default operating mode. If it remains enabled, ownership should be explicit and the business reason for keeping it should be documented.
What to watch for: any user or device still authenticating over clear text is a signal to tighten policy, because that traffic can undermine otherwise strong identity controls. Legacy mail clients are often the last thing standing between a secure configuration and a credential leak.
Practitioner takeaway: keep POP3 exposure narrow, prefer encrypted transport wherever POP3 is unavoidable, and retire clear-text access paths as soon as compatibility allows.
Related resources from NHI Mgmt Group
- How should security teams harden SSH without relying on port changes alone?
- What is the difference between changing port 22 and real SSH hardening?
- What breaks when DTLS session state is tied to IP address and port?
- How should teams secure a self-hosted code server without relying on port forwarding?