Port 50: RMCP — The Quiet Question Before the Inbox

Overview

Port 50 is assigned to the Remote Mail Checking Protocol (RMCP), registered with IANA under the service name re-mail-ck.¹ It operates over both TCP and UDP, though UDP was its native tongue. The protocol does one thing: it asks a mail server whether a user has new mail, and the server answers with two numbers representing time.

That's it. No downloading. No folders. No subjects. Just: "Is there anything waiting for me?"

How RMCP Works

The protocol is almost absurdly minimal.²

A client sends a single UDP datagram to port 50 on the mail server. The datagram contains a 32-bit number set to all zeros, followed by an ASCII username. The server looks up the mailbox for that user and sends back three 32-bit numbers:

1. A zero (reserved)
2. The number of seconds since the last message arrived
3. The number of seconds since the mailbox was last read

That's the entire conversation. One question, one answer. No handshake. No authentication required (though an authenticated mode exists). The server doesn't even distinguish between "this user doesn't exist" and "this user has no mail," a deliberate design choice to prevent username enumeration.

From these two timestamps, a client can derive everything it needs: if the time since last arrival is less than the time since last read, there's unread mail. If they're equal or reversed, nothing new has come in.

The Story of Port 50

Port 50's story begins at the University of Illinois at Urbana-Champaign in 1992, where two engineers, Steve Dorner and Pete Resnick, published RFC 1339.²

Dorner is better known for creating something else entirely: Eudora, one of the most influential email clients ever built.³ He started writing it in 1988, naming it after the author Eudora Welty because of her short story "Why I Live at the P.O." He rearranged the title into a slogan: "Bringing the P.O. to Where You Live."⁴

But before you could bring the post office to where you lived, you had to answer a simpler question: is anything there?

In the early 1990s, that question was expensive to ask. Remote mail protocols like POP required establishing a TCP connection, authenticating, and querying the server, all to find out whether a single new message had arrived. For servers handling many users, this polling was wasteful. For clients on resource-constrained machines, maintaining a full mail protocol implementation just to check for new mail was impractical.

RMCP solved this with elegance: a single UDP datagram out, a single UDP datagram back. No connection state. No authentication overhead. The server barely noticed.

Pete Resnick, Dorner's co-author, would go on to become one of the most important figures in email standards. He edited RFC 2822 and RFC 5322, the specifications that define the Internet Message Format, the very structure of every email sent today.⁵ Both men later joined Qualcomm, where Eudora became a commercial product used by tens of millions.

Why RMCP Disappeared

RMCP was designed for a world of constraints that no longer exist. When POP3 and IMAP matured, they absorbed the "check for mail" function into richer, more capable protocols. IMAP's IDLE command, introduced in RFC 2177, let the server push notifications to the client in real time, eliminating polling entirely. The bandwidth and processing costs that RMCP was designed to avoid became negligible.

Today, no mainstream mail system uses port 50. RMCP is an experimental protocol that solved its problem so well that the problem stopped existing.

Security

RMCP's non-authenticated mode reveals whether a user has mail without any credentials. The RFC acknowledges this: servers should only enable unauthenticated access with user consent.² The authenticated mode supports cleartext passwords, which, by modern standards, is equivalent to no authentication at all.

If you see traffic on port 50 today, it's almost certainly not RMCP. Investigate it.

How to Check for Activity on Port 50

# Check if anything is listening on port 50
sudo lsof -i :50

# On Linux, check with ss
sudo ss -tlnp | grep ':50 '

# Scan a remote host
nmap -p 50 <host>

Related Ports