Authenticate and inspect a maildrop

Let’s have a real POP3 conversation. You can follow along against your own account with openssl:

openssl s_client -connect pop.fastmail.com:995 -crlf -quiet

Port 995 is POP3 over TLS, so the connection is encrypted before the first byte. The server greets you with +OK, and you’re in the authorization state.

Logging in and looking around

The simplest login is USER followed by PASS. Then three commands tell you what’s in the maildrop.

STAT gives the message count and total size in bytes. LIST gives each message number with its size. UIDL gives each message number with its unique ID.

S: +OK POP3 server ready
C: USER [email protected]
S: +OK User accepted
C: PASS ...
S: +OK Maildrop has 2 messages
C: STAT
S: +OK 2 4812
C: UIDL
S: +OK Unique-ID listing follows
S: 1 whqtswO00Q430
S: 2 QhdPYR:00WBw1
S: .

The STAT reply says two messages, 4812 bytes in total. The UIDL reply lists message 1 with ID whqtswO00Q430 and message 2 with ID QhdPYR:00WBw1.

One line or many

Notice the two reply shapes. STAT answers in a single line. UIDL without an argument answers with several lines, and a line containing only a dot marks the end.

This is the same trick as SMTP’s DATA. A real line that starts with a dot gets a second dot on the wire, and the client strips it. Your parser has to know which commands return one line and which return many, or it will hang waiting for a dot that never comes.

Why UIDL matters

Message numbers change between sessions. UIDLs don’t. A client that wants to fetch only new mail keeps a list of UIDLs it already has, calls UIDL, and downloads the ones it hasn’t seen.

Save the UIDL only after the message itself is safely on disk. If you record it first and crash before the download completes, the next session skips that message forever.

Servers keep a UIDL stable as long as the message is in the maildrop. Still, plan for a rebuilt mailbox or a buggy server: if every UIDL suddenly looks new, don’t blindly download everything into duplicates. Compare Message-ID headers or sizes before you commit.

Never on cleartext

USER and PASS send the password as plain text. The only thing protecting it is the TLS layer around the connection. Use port 995, or STLS on port 110, and validate the certificate. Some servers also advertise stronger AUTH mechanisms through the CAPA command.

Try parsing the transcript above into three values: message count, total bytes, and a map from number to UIDL. Then point at the exact line that told you the multiline reply was over.