POP3

How Telescope verifies POP3 server availability, greeting health, and TLS capability.

POP3 monitors verify that a mail server accepts POP3 connections and responds correctly to a protocol handshake. Checks do not authenticate and do not read mailbox contents.

How a check works

Telescope opens a connection to the configured host and port.
It reads the POP3 greeting and validates that the server is ready (+OK).
Telescope sends CAPA to collect server capabilities.
If TLS is required, Telescope negotiates TLS using either:
- STLS (explicit TLS upgrade), or
- implicit TLS (POP3S, commonly port 995).
Telescope re-runs CAPA after STLS (per RFC guidance), sends QUIT, and stores structured protocol details.

Status classification

Condition	Status	What it means
Handshake succeeds and policy checks pass	Up	POP3 endpoint is reachable and protocol flow is healthy
Connection timeout/refusal/DNS failure	Down	POP3 endpoint is unreachable
Malformed or unexpected protocol replies	Down	Server is reachable but not speaking expected POP3 flow
TLS required but secure transport unavailable	Down	Server does not satisfy monitor TLS policy
Greeting/banner verification fails	Down	Server identity/content check failed

POP3 monitors currently classify results as up/down (no degraded state).

Configuration options

Setting	Default	Description
`port`	`995`	POP3 endpoint port
`requireTls` / `requireStartTLS`	`false`	Require secure POP3 transport
`implicitTls`	auto (`true` on port `995`)	Use TLS immediately on connect (POP3S)
`verifyBanner`	unset	Optional substring that must appear in server greeting

Result data highlights

POP3 checks store structured metadata in result_data, including:

connection_mode (plain, stls, implicit_tls)
banner
supports_stls
tls_active, stls_negotiated
tls_protocol, tls_cipher
capabilities (advertised by CAPA)
response_indicators (+OK / -ERR)

Operational notes

STLS checks follow RFC guidance by refreshing capability state after TLS upgrade.
If you need certificate trust/expiry validation, pair POP3 monitors with an SSL monitor on the same host/port.