Email protocols series. This is the tactical POP3 configuration guide. For the conceptual overview of how SMTP, IMAP and POP3 fit together, read the email protocols hub →
Quick POP3 configuration reference
POP3 (Post Office Protocol version 3) downloads mail from the server to a single client and, by default, deletes it from the server. There is no syncing, no shared state, no folders beyond the Inbox. POP3 is the right tool for narrow archival use cases and the wrong tool for almost everything else in 2026.
| Modern default | Port 995 + Implicit TLS + AUTH |
| Legacy alternative | Port 110 + STARTTLS + AUTH |
| Never use | Port 110 without STARTTLS (credentials in plaintext) |
| Critical setting | “Leave a copy on server”, disabled by default in many clients, which deletes server-side mail after download |
| RFC reference | RFC 1939 (1996), still the current standard |
This guide focuses on the actual configuration plus the “leave on server” decision that makes the real difference in how POP3 behaves. For context on what POP3 is and why almost everyone uses IMAP instead, see our email protocols overview and our IMAP configuration guide.
When POP3 still makes sense (and when it doesn’t)
Use POP3 if:
- Single-device, archival workflow. One desktop computer that downloads everything for offline access and archival. No phone, no laptop, no syncing.
- Bandwidth-constrained environments. Slow or metered connection where IMAP’s per-folder syncing is too chatty.
- Migrating mail off a provider. One-time bulk download to a local archive before closing the account.
- Aggregating mail from many small accounts. Some old-school newsletter consolidators pull from POP3 endpoints into a unified local store.
- The provider only offers POP3. Rare in 2026, but some legacy hosting still does.
Use IMAP instead if:
- You read mail on more than one device.
- You want sync (read state, folders, drafts) across clients.
- You need mobile push notifications.
- You want the provider to act as a long-term backup.
The mobile + desktop + web mix that defines modern email use requires IMAP. POP3 in that scenario causes lost mail and confusion: the mobile device downloads-and-deletes before the laptop sees it.
The 4 things every POP3 setup needs
| Setting | What it is | Common values |
|---|---|---|
| Server hostname | The POP3 endpoint of your mail provider | pop.gmail.com, outlook.office365.com, pop.mail.yahoo.com |
| Port | The TCP port | 995 (Implicit TLS, modern default), 110 (STARTTLS, legacy) |
| Authentication | How you prove identity | Username + password (USER/PASS), app password |
| Encryption | How the connection is secured | SSL/Implicit TLS (on 995), STARTTLS (on 110) |
Plus one POP3-specific setting that has more impact than all of the above:
- “Leave a copy of messages on the server” (or “Keep mail on server”, or “Don’t delete after download”). When disabled, the client deletes from the server after download. When enabled, the server keeps a copy. Default varies by client; check it.
Port selection: 995 vs 110
Port 995 (modern default)
Implicit TLS from the first byte. Authentication required. Standard for every modern provider.
Port 110 (legacy with STARTTLS)
Plaintext start, upgrade to TLS via STLS command (RFC 2595). Still supported by major providers but offers no advantage over 995. Use only if 995 is blocked.
Decision rule: always 995 unless forced to 110.
Authentication mechanisms
POP3 keeps it simple:
- USER + PASS. Two commands:
USER user@example.comfollowed byPASS password. Universal default. Used over TLS so credentials don’t leak. - APOP. Challenge-response authentication that hashes the password. Largely obsolete; TLS makes the hashing redundant.
- SASL (AUTH command). Allows OAuth2 and other modern mechanisms. Supported by some providers (Gmail does XOAUTH2 over POP3), but POP3-with-OAuth2 is an uncommon combination because the providers that push OAuth2 also push IMAP for everything else.
- App passwords. Same as SMTP and IMAP: required for 2FA accounts.
The “leave on server” decision
This is the setting that determines whether POP3 is destructive or non-destructive.
Disabled (default in many clients)
Client downloads the message, sends a DELE command, server removes the message. From any other device, the message is gone. Useful for: dedicated single-device archival. Dangerous for: anyone who occasionally checks mail on their phone “just to see”.
Enabled
Client downloads the message; server keeps it. The next POP3 client (or the IMAP/web view) still sees the message in the Inbox. Useful for: multi-device workflows where one device is the “real” reader and others occasionally peek. The risk: server fills up over time because POP3 doesn’t sync deletes the other way.
The “delete after N days” compromise
Most modern clients add a third option: keep on server for N days, then delete. Reasonable compromise for archival use: the server retains recent mail (so other devices see it), old mail moves only to the archive client. Common values: 7, 14, 30 days.
Setup walkthrough by client type
Desktop clients (Thunderbird, Apple Mail, Outlook desktop)
Add account → manual configuration → choose POP3 (instead of IMAP). Set POP3 server hostname, port 995, SSL/Implicit TLS, username, password. Critically, check the “Leave messages on server” setting before first sync. Default behavior varies; Thunderbird leaves on server by default, Outlook removes by default.
Server-side aggregators
Tools like getmail or fetchmail pull from POP3 endpoints into a local mailbox for further processing (forwarding, parsing, archival). Configuration is hostname, 995, credentials, plus an explicit “delete on server” decision per endpoint.
Mobile (rare)
Most mobile mail apps support POP3 but discourage it. iOS Mail offers POP3 in the advanced setup options; the experience is poor (no folder sync, no push). Use only when no alternative exists.
Provider-specific quick links
- Gmail POP3 settings (pop.gmail.com, 995, app password; must be enabled in Settings → Forwarding and POP/IMAP)
- Outlook / Microsoft 365 POP3 settings (outlook.office365.com or pop-mail.outlook.com, 995)
- Yahoo Mail POP3 settings (pop.mail.yahoo.com, 995, app password required)
- iCloud (POP3 not supported; IMAP only)
Note: iCloud, ProtonMail, and several modern privacy providers do not expose POP3 at all. If POP3 is your hard requirement, confirm the provider supports it before signing up.
Testing your POP3 setup
OpenSSL connection test
openssl s_client -connect pop.example.com:995 -crlfShows the TLS handshake and the server’s POP3 greeting (+OK). Then:
USER user@example.com
PASS app-password
STAT
LIST
QUITSTAT returns message count and total size; LIST returns size per message. If these work without errors, the server side is healthy.
Diagnosing common POP3 errors
| Error | Likely cause | Fix |
|---|---|---|
-ERR Authentication failed | Wrong password, or 2FA + main password used | Generate app password |
-ERR POP3 access is disabled | Provider has POP3 off for this account | Enable in web UI (Gmail Settings, Yahoo, Microsoft) |
| “Mailbox in use” / “Lock failed” | Another client is mid-POP3 session | Wait 5 minutes; ensure only one POP3 client at a time |
| All messages re-download on every check | Server doesn’t honor message UID tracking; “leave on server” not honored | Enable UIDL tracking in client; some legacy POP3 servers don’t support persistent UIDs |
| Server mailbox fills up over time | “Leave on server” enabled without cleanup window | Set “delete after N days”; clean up periodically via web UI |
| Messages missing on other devices | POP3 deleted from server after download elsewhere | Switch to IMAP, or enable “leave on server” everywhere |
| Timeout on port 110 or 995 | Firewall blocking, or wrong hostname | Test with openssl/telnet |
-ERR Try the latest Yahoo Mail | Yahoo deprecation warning for legacy POP3 access | Confirm POP3 is still enabled in Yahoo account settings; generate fresh app password |
10 common POP3 setup mistakes
- Using POP3 on multiple devices. Mail disappears from one device when another downloads it. Use IMAP instead.
- Forgetting to enable POP3 in the web UI. Gmail, Microsoft, Yahoo all require explicit opt-in.
- Leaving “delete on server” enabled by accident. Especially destructive on first sync if you had years of mail in the Inbox.
- Skipping TLS on port 110. Credentials and message bodies leak in plaintext.
- Pairing port 995 with STARTTLS, or 110 with Implicit TLS. Combinations must match.
- Not setting a “delete after N days” cleanup. Mailbox grows unbounded, eventually hitting provider quota.
- Treating POP3 as backup. If the local archive is the only copy and the disk dies, your mail is gone. Real backup is separate.
- Using POP3 with mobile. No push, no folder sync, poor experience. Mobile wants IMAP.
- Frequent polling. POP3 has no equivalent of IMAP IDLE. Polling every 60 seconds is wasteful; every 15 minutes is reasonable.
- Assuming POP3 will work indefinitely. Major providers are gradually deprecating POP3 in favor of IMAP and modern auth. Check your provider’s roadmap.
POP3 configuration FAQ
Should I use POP3 or IMAP?
IMAP for almost everything. POP3 only fits a narrow set of cases: single-device archival, bandwidth-constrained environments, one-time bulk download for migration. Any modern multi-device workflow needs IMAP for state sync across devices. See our IMAP configuration guide for the recommended setup.
Does POP3 delete my mail from the server?
By default, yes. After downloading a message, the client sends a DELETE command and the server removes the message. Most clients let you change this by enabling “leave a copy on server”, which downloads without deleting. Always verify this setting before first sync, especially when migrating from another setup; the first sync can be irreversibly destructive if “leave on server” is off.
Can I use POP3 and IMAP at the same time on the same account?
Most providers technically allow both, but the combination causes confusing behavior: POP3 may download and delete a message before IMAP clients see it; or POP3 leaves messages that IMAP later marks as read, but the POP3 client doesn’t know. If you must mix, enable “leave on server” on POP3 with a long retention window, and treat IMAP as primary. In practice, pick one protocol.
Why does my POP3 client re-download all messages every check?
The client isn’t tracking message UIDs persistently. POP3 uses the UIDL command to assign each message a unique ID; the client should remember which UIDs it has already downloaded. If the local UID cache is corrupted or disabled, every message looks new. Enable UIDL tracking in the client settings, or clear the local cache and let it rebuild. Some very old POP3 servers don’t support UIDL; in that case, the client treats every check as a fresh download.
Are major providers deprecating POP3?
Gradually. Microsoft has been pushing OAuth2 and modern auth for years, and basic POP3 with password authentication is increasingly discouraged. Yahoo has reduced POP3 functionality. Gmail still fully supports POP3 but pushes IMAP everywhere. iCloud, ProtonMail, and other privacy-first providers don’t offer POP3 at all. POP3 is not gone, but it is on a slow decline; budget accordingly if it’s mission-critical for you.
Does POP3 support push notifications?
No. POP3 is a pull-only protocol. Clients poll the server at a set interval (every 5, 15, 60 minutes typically). Real-time notifications require IMAP IDLE, push-based services, or proprietary protocols like Exchange ActiveSync. POP3’s polling model is part of why it’s a bad fit for mobile.
Final words
POP3 setup is short because POP3 is small: download, optionally delete, disconnect. The two settings that matter are the port (995 with Implicit TLS) and the “leave on server” toggle. Get those right and POP3 does what POP3 does well: pull mail to a single archival destination.
If you find yourself wrestling with POP3 to coordinate access across multiple devices, you’re using the wrong tool. Switch to IMAP and the friction disappears.
For broader context, see the email protocols overview, the companion IMAP configuration guide, the SMTP setup guide, and our SSL/TLS for email guide.
Clean your list before POP3 pulls a single byte.
SMTPing catches what regex misses: disposable addresses, role-based emails, catch-all domains, syntax errors, dead mailboxes and known traps. 13 validation types, 25 free checks daily, no card required.
About the Author
Alaa · LinkedIn
Email infrastructure specialist with 8+ years of hands-on experience in SMTP, deliverability, and email verification. I’ve configured and troubleshot mail systems across Postfix, Exchange, and cloud relays, managed IP reputation and warmup campaigns, and built verification pipelines processing millions of addresses. My work spans DNS authentication (SPF, DKIM, DMARC, BIMI), bounce handling, blocklist monitoring, and compliance frameworks including CAN-SPAM and GDPR. I write every article on SMTPedia to give email professionals, developers, and marketers the accurate, RFC-grounded reference they need.
About SMTPedia
SMTPedia is an independent email industry reference covering SMTP, IMAP, POP3, email deliverability, marketing platforms, DNS authentication, and email verification. Every article is researched from official provider documentation, IETF RFCs, and industry best practices. Settings and configurations are verified quarterly.
We are cited as a source by ChatGPT, Microsoft Copilot, and thousands of email professionals worldwide. Learn more about our editorial process.
