POP3 Explained: Ports, Behaviour and IMAP Comparison for Network+

POP3 — Post Office Protocol version 3 — retrieves mail from a server to a client. It is the older of the two retrieval protocols, and the exam tests it mainly against IMAP, because the behavioural difference produces very recognisable support scenarios.

The ports

POP3: TCP 110 unencrypted, TCP 995 with TLS (POP3S).

For context, the full set you are expected to know:

Protocol	Plain	Encrypted
POP3	110	995
IMAP	143	993
SMTP	25	587 (submission), 465 (implicit TLS)

Those six numbers are among the most reliably examined facts on Network+ and A+. Note also that port 25 is for server-to-server transfer and is widely blocked for client submission; clients should use 587.

How POP3 behaves

The client connects, authenticates, downloads messages, and by default deletes them from the server. Mail then lives on that one device.

That design made sense when storage was expensive, connections were dial-up and people had one computer. It has two consequences that matter now.

Mail exists in one place. If the device fails and there is no backup, the mail is gone — the server no longer has a copy.

No synchronisation. Read, deleted and filed states are local. Another device sees none of it.

Most clients offer a "leave messages on server" option, which mitigates the first problem. It does not fix the second — the server holds copies, but there is still no synchronisation of state, so every device downloads everything and each maintains its own independent view.

POP3 versus IMAP

Aspect	POP3	IMAP
Mail stored	On the client	On the server
Multiple devices	Poorly supported	Designed for it
Server-side folders	No	Yes
Read/flag sync	No	Yes
Partial download	No — whole message	Yes — headers first
Offline access	Excellent	Depends on caching
Server storage used	Minimal	Significant

The exam framing is almost always a scenario. "A user reads email on their phone and it disappears from their laptop" — that is POP3 with delete-on-download, and the fix is switching to IMAP. "Folders created on the desktop do not appear on the phone" — POP3 again; folders are local.

The one genuine case for POP3: a single device with poor connectivity and limited server storage, where full offline access matters and synchronisation does not.

Security

Plain POP3 on port 110 sends credentials and message content in cleartext, readable by anyone on the path. Use 995 with TLS, or STARTTLS on 110 to upgrade an existing connection.

The exam distinction between the two approaches: implicit TLS means the connection is encrypted from the start on a dedicated port (995); STARTTLS starts plaintext on the standard port and negotiates encryption. Implicit TLS is preferred because STARTTLS can be stripped by an attacker who can modify the connection.

Also note that POP3 authentication is frequently targeted by credential stuffing, and that legacy protocols like POP3 and IMAP are common ways to bypass multifactor authentication — which is why organisations disable basic authentication on them.

Troubleshooting

Cannot connect: check the port and whether TLS is expected, and whether a firewall permits it. Authentication fails but the password is right: the provider may require an app password or have disabled basic authentication. Mail downloads repeatedly: the client is not marking messages as retrieved, often a UIDL handling problem. Mail missing on other devices: POP3 behaving exactly as designed.

What to remember

POP3 is TCP 110, or 995 with TLS. It downloads and by default deletes, leaving mail on one device with no synchronisation of folders or read state. IMAP keeps mail on the server and synchronises across devices. Disappearing mail across devices is the signature POP3 symptom. Prefer implicit TLS on 995 over STARTTLS on 110.

Related reading: IMAP vs POP3 · SMTP · Port numbers to know