The POP3 model

POP3 is the simplest way to get mail out of a server. The idea fits in one sentence: log in, download the messages, optionally delete them from the server, log out.

The server side is called a maildrop. It’s a single pile of messages, no folders. POP3 was designed for a world where you had one computer and dialed in to fetch your mail. That design still shows.

Three states

A POP3 session moves through three states, and each command is only legal in one of them:

TCP/TLS connected -> AUTHORIZATION -> TRANSACTION -> UPDATE -> closed

Authorization is where you prove who you are, with USER and PASS or a stronger mechanism. Transaction is where you work: STAT, LIST, UIDL, RETR, DELE. Update happens when you send QUIT. Only then does the server actually delete what you marked.

Every server reply starts with +OK or -ERR. That’s the entire vocabulary for success and failure. No numeric codes like SMTP.

Message numbers are not IDs

In a session, messages are numbered 1, 2, 3 from the top of the maildrop. Those numbers are positions, and they’re only valid for this session.

Say you delete message 2 today. Tomorrow the old message 3 is the new message 2. If your client remembered “I already downloaded 2”, it just skipped a message.

The durable identifier is the UIDL, a unique string the server assigns to each message. Remember UIDLs, never positions.

Save first, delete second

Here is the failure that loses mail. A client downloads message 4, sends DELE 4, sends QUIT, and then crashes before writing the message to disk. The server has deleted its copy. The only copy is gone.

The correct order is: download, write to local storage, confirm the write completed, and only then send DELE. A slower sync beats a lost message.

One client at a time

Most servers lock the maildrop while a session is open. If your phone and laptop both poll the same POP3 account, the second one often gets -ERR maildrop already locked and has to wait.

This isn’t a bug. It’s POP3 telling you it was designed for one client. If you need several devices to share a mailbox, that’s what IMAP is for, and we’ll get there.

Try writing the valid state next to each of USER, PASS, STAT, RETR, DELE, and QUIT. Then think through what should happen if the TCP connection dies before update. The next lessons confirm your answer.