Authenticate and inspect a maildrop

A POP3 server greets with +OK or fails with -ERR. After a protected connection is established, a simple session may use USER and PASS to enter the transaction state.

STAT returns the message count and total size. LIST returns message numbers and sizes. UIDL returns server-assigned unique identifiers that clients can remember between sessions.

Message numbers are temporary positions in the current maildrop. Use unique IDs, not positions, to avoid downloading the same message repeatedly.

Watch the reply forms:

S: +OK POP3 server ready
C: USER alice
S: +OK User accepted
C: PASS ...
S: +OK Maildrop has 2 messages
C: STAT
S: +OK 2 4812
C: UIDL
S: +OK Unique-ID listing follows
S: 1 whqtswO00Q430
S: 2 QhdPYR:00WBw1
S: .

STAT is one line. UIDL without a message number is multiline and ends with a dot line. As with SMTP, a real response line beginning with a dot is dot-stuffed.

USER and PASS do not protect credentials. Run them only inside a TLS-protected connection whose certificate you validated. A server can also advertise stronger authentication mechanisms through POP3 extensions.

Store the UIDL only after the corresponding message is durable locally. Servers are expected to keep a unique ID stable while that message remains in the maildrop, but a client still needs recovery logic for server bugs or a rebuilt mailbox.

Parse the transcript into message count, total octets, and UID map. Identify which reply tells you the multiline section is complete.