- Require TLS and authenticated submission.
- Make sure the server is not an open relay.
- Publish SPF, DKIM and DMARC for the domain.
Port 512: used by mail system to notify users of new mail received; currently receives messages only from processes on the same machine
Port 512 is assigned by IANA to biff (used by mail system to notify users of new mail received; currently receives messages only from processes on the same machine), comsat (), exec (remote process execution; authentication performed using passwords and UNIX login names).
512
How biff works
EmailMail servers hand messages to each other over port 512, one hop at a time, until the recipient's server.
- Transport
- UDP · TCP
- Exposure risk
- not rated depends on the program listening
- Encryption
- Unknownnot stated by the registry
- IANA status
- Assigned3 registered services
- Range
- Well-known (0-1023)
- Category
Is port 512 dangerous?
We have no specific security note for port 512. Its risk depends on the program actually listening on it. General advice for email services:
IANA registry entries for port 512
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| biff | 512 | UDP | used by mail system to notify users of new mail received; currently receives messages only from processes on the same machine | - | - |
| comsat | 512 | UDP | - | - | |
| exec | 512 | TCP | remote process execution; authentication performed using passwords and UNIX login names | - | - |
// source: IANA service name and port number registry
Which program uses port 512, and is it reachable?
Linux
sudo ss -ltnup 'sport = :512' # process listening on 512
sudo lsof -nP -i :512macOS
sudo lsof -nP -i :512
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 512 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 512 netstat -ano | findstr :512
From another machine
nmap -p 512 -sV <host> sudo nmap -sU -p 512 <host> nc -zv <host> 512
Block it in the firewall
sudo ufw deny 512/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 512" -Direction Inbound -LocalPort 512 -Protocol TCP -Action Block # Windows
What is port 512 used for?
Port 512 is assigned by IANA to biff (used by mail system to notify users of new mail received; currently receives messages only from processes on the same machine), comsat (), exec (remote process execution; authentication performed using passwords and UNIX login names).
Is port 512 TCP or UDP?
Port 512 is registered for UDP and TCP.
Is it safe to open port 512?
It depends on the program that listens on it. Open it only for a service you know and only to the networks that need it. Require TLS and authenticated submission.
How do I check if port 512 is open?
On Linux run "ss -ltnup 'sport = :512'", on macOS "lsof -nP -i :512", and on Windows "netstat -ano | findstr :512" to see the local process. From another machine, "nmap -p 512 <host>" shows whether it is reachable.