What Is POP3? Why It's the Wrong Migration Protocol

POP3 is the oldest mail-reading protocol still in active use, and it is almost always the wrong protocol for an email migration. If you find a user whose Outlook profile is configured for POP3, stop and audit before you copy anything — there is a real chance most of their archive no longer lives on the server. This page explains what POP3 actually does, where it still turns up, and what to do when you find it during a cutover audit.

What POP3 is#

POP3 stands for Post Office Protocol version 3. It is defined in RFC 1939 and has been stable since 1996. The mental model is a physical post office box. The client connects, the server hands over every new message, and the client takes them home. By default, the server then throws its copy away.

That model made sense in the dial-up era. Connections were expensive, mailboxes were small, and people read mail on exactly one device. Today it creates more problems than it solves.

How POP3 works in practice#

A POP3 session is short and stateless.

1. The client connects on port 110 or 995.
2. It authenticates with username and password.
3. It issues LIST to see what's new.
4. It issues RETR to pull each message.
5. It issues DELE to mark each message for deletion.
6. It closes the connection. The server commits the deletions.

There is no concept of folders, flags, drafts, sent items, or sync. Everything POP3 cares about lives in the inbox and only the inbox. Anything you want to organise has to happen on the client side, which is why POP3 users end up with thousands of local PST files and Maildrop folders that the server has never seen.

Ports#

POP3 has two:

• 110 — plaintext, optionally upgraded with STLS.
• 995 — implicit TLS, often called POP3S.

If you must speak POP3 at all, only use 995. Port 110 with credentials in the clear is unacceptable on any network you don't fully control.

Why POP3 is the wrong protocol for migrations#

A migration tool's job is to make the destination look like the source. POP3 makes that almost impossible.

• No folders. POP3 only exposes the inbox. Sent items, drafts, archive, and any custom folders the user built over the years are invisible.
• No flags. Read/unread state, stars, flags and labels do not exist in the protocol.
• No idempotency. POP3 has no UIDs you can rely on across sessions. Re-running a sync usually means duplicates.
• Possibly nothing to copy. If the user ran POP3 with "leave on server" disabled, the server has been deleting mail as it was downloaded. The only complete copy lives in a local data file.

This is why every serious migration runs over IMAP instead. IMAP exposes the full folder hierarchy, the full flag set, and stable UIDs you can resume from.

Where POP3 still shows up#

It hasn't disappeared. You will still meet POP3 in a few places.

• Old shared hosting. Some cPanel and Plesk hosts still ship POP3/995 enabled by default for backwards compatibility.
• Embedded devices. Multifunction printers, alarm panels and a surprising number of factory-floor systems poll a mailbox over POP3 to pick up jobs or alerts.
• Personal accounts on ISPs. A handful of regional ISPs in Europe and Asia still offer POP3 as the only protocol for free email accounts.
• Forwarders. Some users configured a Gmail "Check mail from other accounts" rule that uses POP3 behind the scenes. That doesn't change the destination's behaviour, but it can mean a mailbox is being silently drained.

For the device cases, leave POP3 alone if you can. Just point the device at the new server's POP3 endpoint after cutover. For everything else, move the user to IMAP before you start.

POP3 and the migration runbook#

If POP3 appears during an audit, your runbook needs one extra step before you touch the server. Read the complete email migration guide for the broader sequence, but the POP3-specific addition is simple: collect every local mail data file from the user's machine first. PST on Windows, mbox or Mail Drawer on macOS. Those files are the only place the user's full history exists. Once they are safely on a share, you can migrate the server contents and import the local archive on the destination side.

After cutover, also update the MX record and confirm the device polling the new POP3 endpoint still authenticates. Old printers in particular tend to be stuck on plaintext port 110 and will silently stop fetching jobs.