Skip to main content

7. Optional POP3 Commands

The POP3 commands discussed above must be supported by all minimal implementations of POP3 servers.

The optional POP3 commands described below permit a POP3 client greater freedom in message handling, while preserving a simple POP3 server implementation.

NOTE: This memo STRONGLY encourages implementations to support these commands in lieu of developing augmented drop and scan listings. In short, the philosophy of this memo is to put intelligence in the part of the POP3 client and not the POP3 server.

TOP Command​

Format: TOP msg n

Arguments: a message-number (required) which may NOT refer to a message marked as deleted, and a non-negative number of lines (required)

Restrictions: may only be given in the TRANSACTION state

Discussion: If the POP3 server issues a positive response, then the response is multi-line. After the initial +OK, the POP3 server sends the headers of the message, the blank line separating the headers from the body, and then the number of lines of the indicated message's body, being careful to byte-stuff the termination character (as with all multi-line responses).

Possible Responses:

  • +OK
  • -ERR

Examples:

C: TOP 1 10
S: +OK
S: <the POP3 server sends the headers of the message, a blank line, then the first 10 lines of the body of the message>
S: .

UIDL Command​

Format: UIDL [msg]

Arguments: a message-number (optional), which, if present, may NOT refer to a message marked as deleted

Restrictions: may only be given in the TRANSACTION state

Discussion: If an argument was given and the POP3 server issues a positive response with a line containing information for that message. This line is called a "unique-id listing" for that message. The unique-id of a message is an arbitrary server-determined string, consisting of one to 70 characters in the range 0x21 to 0x7E, which uniquely identifies a message within a maildrop and which persists across sessions. The server should never reuse a unique-id in a given maildrop, for as long as the entity using the unique-id exists.

Possible Responses:

  • +OK
  • -ERR

Examples:

C: UIDL
S: +OK
S: 1 whqtswO00WBw418f9t5JxYwZ
S: 2 QhdPYR:00WBw1Ph7x7
S: .

USER Command​

Format: USER name

Arguments: a string identifying a mailbox (required), which is of significance ONLY to the server

Restrictions: may only be given in the AUTHORIZATION state after the POP3 greeting or after an unsuccessful USER or PASS command

Discussion: To authenticate using the USER and PASS command combination, the client must first issue the USER command. If the POP3 server responds with a positive status indicator ("+OK"), then the client may issue either the PASS command to complete the authentication, or the QUIT command to terminate the POP3 session.

Possible Responses:

  • +OK
  • -ERR

Examples:

C: USER frated
S: +OK User name accepted, password please

PASS Command​

Format: PASS string

Arguments: a server/mailbox-specific password (required)

Restrictions: may only be given in the AUTHORIZATION state immediately after a successful USER command

Discussion: When the client issues the PASS command, the POP3 server uses the argument pair from the USER and PASS commands to determine if the client should be given access to the appropriate maildrop.

Possible Responses:

  • +OK
  • -ERR

Examples:

C: PASS secret
S: +OK maildrop locked and ready

APOP Command​

Format: APOP name digest

Arguments: a string identifying a mailbox and an MD5 digest string (both required)

Restrictions: may only be given in the AUTHORIZATION state after the POP3 greeting or after an unsuccessful USER or PASS command

Discussion: Normally, each POP3 session starts with a USER/PASS exchange. This results in a server/user-id specific password being sent in the clear on the network. For intermittent use of POP3, this may not introduce a sizable risk. However, many POP3 client implementations connect to the POP3 server on a regular basis -- to check for new mail. Further the interval of session initiation may be on the order of five minutes. Hence, the risk of password capture is greatly enhanced.

An alternate method of authentication is required which provides for both origin authentication and replay protection, but which does not involve sending a password in the clear over the network. The APOP command provides this functionality.

Possible Responses:

  • +OK
  • -ERR

Examples:

S: +OK POP3 server ready ``<[email protected]>``
C: APOP mrose c4c9334bac560ecc979e58001b3e22fb
S: +OK maildrop has 1 message (369 octets)

Glossary:

  • unique-id: Persistent message identifier
  • MD5 digest: Cryptographic hash for authentication
  • AUTHORIZATION state: Initial authentication phase
  • TRANSACTION state: Main operational phase
Last updated on