diff --git a/CHANGES b/CHANGES
index e831d3d6c..3f2dbc743 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2354,4 +2354,5 @@
 * services: add recovery mode
 * postgresql: fix restore issue with long table names
 * recvmail: make the addon work again
+* mail: update solr to 8.10.0
 
diff --git a/setup/start/cloudron-firewall.sh b/setup/start/cloudron-firewall.sh
index a11fae074..55bd37c5f 100755
--- a/setup/start/cloudron-firewall.sh
+++ b/setup/start/cloudron-firewall.sh
@@ -81,8 +81,8 @@ for port in 2525 4190 9993; do
     iptables -A CLOUDRON_RATELIMIT -p tcp --syn ! -s 172.18.0.0/16 -d 172.18.0.0/16 --dport ${port} -m connlimit --connlimit-above 50 -j CLOUDRON_RATELIMIT_LOG
 done
 
-# msa, ldap, imap, sieve
-for port in 2525 3002 4190 9993; do
+# msa, ldap, imap, sieve, pop3
+for port in 2525 3002 4190 9993 9995; do
     iptables -A CLOUDRON_RATELIMIT -p tcp --syn -s 172.18.0.0/16 -d 172.18.0.0/16 --dport ${port} -m connlimit --connlimit-above 500 -j CLOUDRON_RATELIMIT_LOG
 done
 
diff --git a/src/apps.js b/src/apps.js
index 64608dc17..1b587ab59 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -206,6 +206,7 @@ function validatePortBindings(portBindings, manifest) {
         465, /* smtps */
         587, /* submission */
         993, /* imaps */
+        995, /* pop3s */
         2003, /* graphite (lo) */
         2004, /* graphite (lo) */
         2514, /* cloudron-syslog (lo) */
diff --git a/src/infra_version.js b/src/infra_version.js
index 8b484f430..fde833b79 100644
--- a/src/infra_version.js
+++ b/src/infra_version.js
@@ -20,7 +20,7 @@ exports = module.exports = {
         'postgresql': { repo: 'cloudron/postgresql', tag: 'cloudron/postgresql:4.1.1@sha256:86e4e2f4fd43809efca7c9cb1def4d7608cf36cb9ea27052f9b64da4481db43a' },
         'mongodb': { repo: 'cloudron/mongodb', tag: 'cloudron/mongodb:4.0.2@sha256:9df297ccc3370f38c54f8d614e214e082b363777cd1c6c9522e29663cc8f5362' },
         'redis': { repo: 'cloudron/redis', tag: 'cloudron/redis:3.0.4@sha256:5c60de75d078ae609da5565f32dcd91030f45907e945756cc976ff207b8c6199' },
-        'mail': { repo: 'cloudron/mail', tag: 'cloudron/mail:3.4.0@sha256:19934adb89499942c0ae81580be71442f2482401dbf0618e13a04ff478bbfdb7' },
+        'mail': { repo: 'cloudron/mail', tag: 'cloudron/mail:3.4.0@sha256:a67fb9fc4f3bae70b4217ef8379c65503f5e1d067378385301363c4fb376e196' },
         'graphite': { repo: 'cloudron/graphite', tag: 'cloudron/graphite:3.0.1@sha256:bed9f6b5d06fe2c5289e895e806cfa5b74ad62993d705be55d4554a67d128029' },
         'sftp': { repo: 'cloudron/sftp', tag: 'cloudron/sftp:3.4.0@sha256:2804a2ad5645a771c30ce56b3fbbec05f5b9d9284a5e402450a7e1c1d9a10eab' }
     }
diff --git a/src/mail.js b/src/mail.js
index 37c102b8a..ad4821751 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -694,7 +694,7 @@ async function configureMail(mailFqdn, mailDomain, serviceConfig) {
 
     const allowInbound = await createMailConfig(mailFqdn, mailDomain);
 
-    const ports = allowInbound ? '-p 587:2587 -p 993:9993 -p 4190:4190 -p 25:2587 -p 465:2465' : '';
+    const ports = allowInbound ? '-p 587:2587 -p 993:9993 -p 4190:4190 -p 25:2587 -p 465:2465 -p 995:9995' : '';
     const readOnly = !serviceConfig.recoveryMode ? '--read-only' : '';
     const cmd = serviceConfig.recoveryMode ? '/bin/bash -c \'echo "Debug mode. Sleeping" && sleep infinity\'' : '';