---
title: POP3 monitoring: mailbox login, TLS and new mail with WatchFor
description: Monitor a POP3 server the way a mail client meets it — TLS and certificate, capabilities, login, mailbox size, the age of the newest message — with a mail server grade from A+ to F.
canonical: https://watchfor.io/docs/monitors/pop3
---

# POP3 monitoring: mailbox login, TLS and new mail with WatchFor

Monitor a POP3 server the way a mail client meets it — TLS and certificate, capabilities, login, mailbox size, the age of the newest message — with a mail server grade from A+ to F.

POP3 is still what many scanners, ticketing systems, shop backends and older
mail clients use to collect mail. When the POP3 server stops accepting the
login, nothing errors loudly: tickets and orders simply stop arriving. A
**POP3 monitor** connects the way those clients do and tells you when the
server, its certificate or the login stops working, when the mailbox
stops receiving mail, or when it grows towards your provider's limit.

Each check connects, negotiates TLS, reads the greeting and the server's
capabilities (`CAPA`) and, when you give it a login, signs in, reads the
message count and mailbox size (`STAT`) and the `Date` header of the newest
message (`TOP n 0`, headers only). Nothing is downloaded or deleted, and no
subject or sender is stored.

**Target:** the POP3 server's host name, for example `pop.example.com`.

POP3 monitors are on the **Pro** and **Business** plans, like SMTP, FTP and
SFTP. For IMAP servers, see [IMAP](/docs/monitors/imap); to test delivery
end to end, see [Email round-trip](/docs/monitors/email-round-trip).

## Settings

| Setting | Notes |
| --- | --- |
| **Encryption** | **Implicit TLS** (port 995, encrypted from the first byte, the safest choice), **STARTTLS** (port 110, connects in plain text and upgrades with `STLS`; the check fails if the server stops offering the upgrade) or **None** (port 110, greeting and capabilities only). |
| **Port** | Follows the encryption mode (995 or 110) unless you type a custom port. |
| **Verify certificate** | On by default: an expired, self-signed or mismatched certificate fails the check. Off still reports the certificate, it just stops failing on it. |
| **Username** | Optional. Empty means a connection-only check: greeting, TLS and capabilities. |
| **Password** | Required with a username. Stored encrypted and never shown again (see [Credentials](#credentials)). |
| **Track newest message age** | On by default. Reads only the headers of the newest message to learn when it arrived, so you can alert when mail stops coming in. |
| **Timeout** and **IP version** | Seconds per connection (default 15, at most 60); Auto / IPv4 / IPv6. |

A login always needs Implicit TLS or STARTTLS. With **None**, the monitor
never sends credentials; it checks the greeting and capabilities and reports
whether the server would accept a password on that unencrypted connection.

POP3 allows one session per mailbox at a time. A check holds the mailbox only
briefly, but if a client polls the same mailbox constantly, a
check can occasionally find it locked; the confirmation from repeated
checks keeps that from opening an incident.

### Gmail, Microsoft 365 and other providers

- **Gmail and Google Workspace** need an
  [app password](https://support.google.com/accounts/answer/185833), which
  requires 2-Step Verification on the account, and POP must be enabled in
  the Gmail settings.
- **Microsoft 365 and Outlook.com** have turned off password (basic) logins
  for IMAP and POP3. WatchFor does not support OAuth sign-in yet, so a login
  check against a Microsoft 365 mailbox fails. A connection-only check (no
  username) still works and still grades TLS and the certificate.
- **Your own server** or a hosting provider's mail: use a dedicated
  monitoring account rather than a person's login.

## What each check measures

| Stage | What it tells you |
| --- | --- |
| **DNS, connect** | Resolve time and TCP connect time to the port. |
| **TLS** | Handshake time, negotiated TLS version and cipher, the certificate's subject, issuer, expiry and whether it verifies. |
| **Greeting, capabilities** | How fast the server says hello and what `CAPA` lists. In STARTTLS and None mode also whether `STLS` is offered and whether a password login is offered before encryption. |
| **Login** | Whether the username and password are accepted, how long it takes, and the kind of failure when it is not. |
| **Mailbox** | Number of messages and total mailbox size (`STAT`), shown on the monitor page as **Mailbox size** right after Uptime and Incidents. |
| **Newest message** | When the newest message was sent (its `Date` header) and how many seconds ago that was. Needs the server's optional `UIDL` and `TOP` commands; an empty mailbox reports no age. |

Every stage's duration is stored, so a slow check shows where the time went.

### Mailbox size and quota

POP3 has no command to ask for a quota, so a POP3 monitor knows how big the
mailbox is and how many messages it holds, but not the provider's limit. To
be warned before the mailbox fills up and new mail starts bouncing, switch
on **Mailbox Size** and enter a size a little below your limit, in MB. The
monitor page then shows a thin bar that fills towards that size: grey,
amber from 90 % of it, red from 99 %. If the same mailbox is reachable over
IMAP and the server reports a quota there, an [IMAP monitor](/docs/monitors/imap#mailbox-quota)
shows the real limit and alerts on the percentage.

### Mail server grade

The monitor page grades the server from **A+** to **F** from the latest check,
with the reasons listed under the letter. It starts at A+ and each finding
caps it:

| Finding | Grade at most |
| --- | --- |
| No encryption (Encryption: None), failed TLS handshake, or a certificate that is expired or not trusted | F |
| TLS 1.0 or 1.1 negotiated | C |
| A password login offered before encryption | C |
| Certificate expires within 7 days | C |
| Certificate expires within 14 days | B |
| Login rejected | B |
| The whole check took longer than 5 seconds | B |
| STARTTLS instead of implicit TLS | A |
| TLS 1.2 rather than 1.3 | A |

A check that never reached the server (DNS failure, connection refused, a
timeout before TLS) gets no grade.

## Alert presets

| Preset | Default | Fires when |
| --- | --- | --- |
| **Probe Status** | on (locked, critical) | The server can't be reached, TLS fails, or (with a login) the login or reading the mailbox fails. |
| **Login Failed** | on when a username is set (critical) | The server refuses the monitor's login. |
| **Certificate Expiry** | on (warning) | The certificate has fewer than 14 days left. Nothing to measure with Encryption: None. |
| **Certificate Not Trusted** | off | The certificate does not verify (expired, self-signed, wrong host name, incomplete chain). With **Verify certificate** on, such a certificate already fails the check; this preset is for monitors that skip verification. |
| **Plaintext Login Offered** | off | The server offers a password login on an unencrypted connection, before `STLS` or with TLS off. Measured in STARTTLS and None modes. |
| **STARTTLS Not Offered** | off | The server on the plain port does not offer `STLS`, so clients there cannot encrypt at all. Measured in STARTTLS and None modes. |
| **Slow Check** | off | The whole check (connect, TLS, greeting, login and mailbox) takes longer than 5000 ms. |
| **No New Mail** | off | The newest message is older than the threshold in seconds (86400 = a day). Needs a login. |
| **Mailbox Size** | off | The mailbox is larger than the size you set, in MB (500 MB by default, 1 MB = 1,024 KB). Needs a login. |

### Metrics for custom rules

All POP3 metrics are in the `pop3.` namespace, for example
`metrics['pop3.mailbox_bytes'] > 524288000` (500 MB) for a mailbox that
nobody empties.

| Metric | Meaning |
| --- | --- |
| `pop3.error_count` | `1` when the check failed (connection, TLS or login). |
| `pop3.auth_ok` | `1` login accepted, `0` refused. Only reported when a username is set. |
| `pop3.cert_days_left`, `pop3.cert_valid` | Days until the certificate expires; `1` when it verifies. |
| `pop3.tls_version` | Negotiated version: `1.0` to `1.3`. |
| `pop3.stls_offered`, `pop3.plaintext_login_allowed` | `STLS` offered on the plain port; a password login offered without encryption (`1` is bad). STARTTLS and None modes only. |
| `pop3.messages`, `pop3.mailbox_bytes` | Number of messages and mailbox size in bytes (`STAT`). Reported on every check that logs in. |
| `pop3.newest_message_age_s` | Seconds since the newest message was sent. |
| `pop3.check_time_ms` | The whole check. |
| `pop3.dns_time_ms`, `pop3.connect_time_ms`, `pop3.tls_time_ms`, `pop3.greeting_ms`, `pop3.capa_ms`, `pop3.auth_ms`, `pop3.stat_ms`, `pop3.uidl_ms`, `pop3.top_ms` | Per-stage timings. |

## Credentials

The mailbox password is handled the same way as for
[IMAP](/docs/monitors/imap#credentials):

- **Encrypted at rest** (AES-256-GCM) and bound to this monitor, so the
  stored value can't be decrypted for any other monitor or organization.
- **Write-only**: after saving, the form shows that a password is saved,
  never the password. API and MCP responses return it as `"[redacted]"`, and
  it never appears in check results, error messages, logs, exports or the
  activity log.
- When you edit the monitor, leave the field as is to keep the saved
  password or press **Replace** to set a new one. Clearing the username
  deletes the saved password with it.
- A saved password never follows the monitor somewhere else: changing the
  server, port, encryption or username, or turning certificate checks off,
  asks for the password again (the API answers `400` until it is sent).
- Only ever sent over an encrypted connection. A monitor never logs in with
  Encryption: None, and in STARTTLS mode it refuses to log in when `STLS` is
  not offered.

## Also via API

Create with `type: "pop3"` (config: `port`, `tlsMode`, `verifyTls`,
`username`, `password`, `checkNewestAge`, `timeoutSeconds`). See the type
catalog for [POP3](/docs/api/monitor-types#pop3).

---

Canonical page: https://watchfor.io/docs/monitors/pop3 · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt