Secure POP3 and know its limits

Cleartext mailbox access exposes credentials and messages. Modern email access should use TLS with certificate validation. POP3 over implicit TLS commonly uses port 995.

POP3 is intentionally narrow. It has no standard hierarchy of synchronized folders, server-side flags such as \Seen, or rich server searches comparable to IMAP.

Choose POP3 for a deliberate download/archive workflow. Choose IMAP or JMAP when several devices need one consistent server-side view.

With implicit TLS, the first application bytes arrive only after the TLS handshake:

TCP 995 -> TLS handshake -> +OK POP3 greeting -> authentication

Validate the hostname and certificate chain. “Use SSL” with validation disabled only hides an active interception or configuration error.

POP3’s simplicity moves synchronization work to the client. It does not standardize folders, sent-mail upload, read flags, conflict resolution, or server-side search. UIDL helps prevent duplicate downloads, but it is not a complete multi-device state model.

Leaving copies on the server can preserve access from another device, yet each client still decides independently which messages are new and when to delete them. One client’s update can surprise the others.

If a legacy server offers cleartext POP3 only, place replacement or a trusted tunnel on the roadmap. Do not send reusable credentials across an untrusted network.

Compare a phone and laptop using one POP3 account. Write down who owns read state, sent mail, deletion timing, and the archive. Then repeat for IMAP.