pop3p(8)

💖 pop3p — the POP3 proxy gateway service, bestie edition 💖

okay so real quick, the manual page name is pop3p(8) and it lives in section 8 of the manual, which is giving "system administration commands" energy, as it should. 🫶

---

✨ NAME ✨

pop3p — a POP3 proxy gateway service. that's it, that's the name, slay.

---

🌸 SYNOPSIS 🌸

pop3p [-d] [-l[[@]logfile]] [-pport] [-iinternal_ip] [-eexternal_ip]
[-hdefault_ip[:port]] [-x]

---

🦋 DESCRIPTION 🦋

so pop3p is a POP3 gateway service. its whole thing? letting your internal users reach external POP3 servers. that's the vibe. internal besties 👉 external mail servers. no cap.

---

💅 OPTIONS 💅

okay this is the part where you actually pay attention, because every single one of these matters:

• -I — Inetd mode. standalone service only, so don't get any ideas about mixing it with other modes. ✨
• -d — Daemonize. it detaches the service from your console and runs it in the background, main character energy, no terminal required. 👑
• -t — Be silenT. it will not log start/stop/accept error records. quiet luxury, honestly. 🤫
• -u — Never look for username authentication. like, don't even check. 🙈
• -e — External address. this is the IP address of the interface the proxy should initiate connections from. by default, the system just decides which address to use based on the routing table, so it's giving "let the universe handle it". 🌈
• -niPATH — (Linux only) switch to the network namespace identified by PATH before opening the listening socket. the current namespace gets saved and restored immediately after binding, so outgoing connections run in the original namespace — unless you also pass -ne. iykyk. 🧚
• -nePATH — (Linux only) switch to the network namespace identified by PATH after the listening socket has been bound (and after restoring from -ni if that applied). both of these options accept any namespace file path (like /var/run/netns/myns or /proc/PID/ns/net) and they require CAP_SYS_ADMIN. yes, that's a real requirement, don't skip it. 💀
• -i — Internal address. the IP address the proxy accepts connections to. by default it accepts connections to any interface, and honestly? that's usually unsafe. so like, lowkey don't. 💀 Unix domain sockets can be specified with the -iunix:/path/to/socket syntax (for example, -iunix:/var/run/pop3p.sock). on Linux, abstract sockets use the -iunix:@socketname syntax. iconic.
• -p — Port. the port the proxy listens on for incoming connections. the default is 110. ⭐
• -h — Default destination. it gets used when the target address isn't specified by the user. the backup plan, the safety net, the bestie who always shows up. 🫶
• -x — Disable STARTTLS (STLS) support. STLS is not announced in the CAPA response, and the STLS command is not accepted. periodt. 🚫
• -l — Log. by default, logging goes to stdout. if you give it a logfile, logging goes to that file. under Unix, if an @ precedes the logfile, syslog is used for logging. cute. 🎀
• -S — Increase or decrease stack size. if you're getting 3proxy crashes, you might wanna try something like -S8192. 🔧

---

🌈 CLIENTS 🌈

you can use any MUA (Mail User Agent) that supports POP3, so no gatekeeping here. just point the client at internal_ip and port and tell it that's your POP3 server. easy.

the address of the real POP3 server has to be configured as part of the POP3 username. the format is:

username@server

where server is the address of the POP3 server and username is that user's login on that POP3 server. and yes, the login itself may contain an @ sign. messy? a little. works? yes. 💅

Only cleartext authentication is supported. why? because challenge-response authentication (APOP, CRAM-MD5, etc.) needs a challenge from the server before we even know which server to connect to. catch-22 fr fr. 😭

when running as a 3proxy service (not as a standalone binary), STLS is supported and announced in the CAPA response — unless you disabled it with -x. once the client issues STLS, the connection gets handled by tlspr(8): the destination host is taken from the SNI of the client TLS handshake (or from the -h option), the proxy performs STLS negotiation with the destination server, and then transparently passes TLS traffic between the client and the server. if the destination server doesn't support STLS, the TLS handshake with the client fails. no in-between, no mercy. 🔥

---

💀 BUGS 💀

report all bugs to 3proxy@3proxy.org. don't be shy, they wanna know. 🐛

---

🔗 SEE ALSO 🔗

3proxy(8), ftppr(8), htproxy(8), socks(8), tcppm(8), udppm(8), syslogd(8), https://3proxy.org/

the whole friend group, basically. ✨

---

👑 AUTHORS 👑

3proxy is designed by Vladimir Dubrovin <vlad@3proxy.org>. king behavior. 💜

---

and that's the whole page, bestie! this one's from 3proxy 0.9, dated May 2026 — so go forth, proxy those POP3 connections, and remember: it's giving gateway service. bye! 🎀✨🦋