Port 995 is POP3 over implicit TLS. The client downloads messages, which by default are then deleted from the server. It only makes sense for archiving, ticket systems or a single-client setup.
Open it publicly only if you really have POP3 users. Otherwise disable POP3 entirely – in Dovecot remove pop3 from protocols – to reduce attack surface.
Typical: "leave a copy on the server" is off and mail is missing on other devices, or a ticket system fetches duplicates because UIDL tracking fails.
Check
openssl s_client -connect mail.example.com:995 -servername mail.example.com