{"record":{"id":"0bd86f4ef814eb26","repo":"jstedfast/MailKit","slug":"the-smtp-server-does-not-support-the-starttls-extension-0bd86f","errorCode":null,"errorMessage":"The SMTP server does not support the STARTTLS extension.","messagePattern":"The SMTP server does not support the STARTTLS extension\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"MailKit/Net/Smtp/SmtpClient.cs","lineNumber":1369,"sourceCode":"\t\t\t\tstream.Dispose ();\n\t\t\t\tsecure = false;\n\t\t\t\tthrow;\n\t\t\t}\n\n\t\t\tStream = new SmtpStream (stream, ProtocolLogger);\n\n\t\t\ttry {\n\t\t\t\t// read the greeting\n\t\t\t\tvar response = Stream.ReadResponse (cancellationToken);\n\n\t\t\t\tif (response.StatusCode != SmtpStatusCode.ServiceReady)\n\t\t\t\t\tthrow new SmtpCommandException (SmtpErrorCode.UnexpectedStatusCode, response.StatusCode, response.Response);\n\n\t\t\t\t// Send EHLO and get a list of supported extensions\n\t\t\t\tEhlo (true, cancellationToken);\n\n\t\t\t\tif (options == SecureSocketOptions.StartTls && (capabilities & SmtpCapabilities.StartTLS) == 0)\n\t\t\t\t\tthrow new NotSupportedException (\"The SMTP server does not support the STARTTLS extension.\");\n\n\t\t\t\tif (starttls && (capabilities & SmtpCapabilities.StartTLS) != 0) {\n\t\t\t\t\tresponse = Stream.SendCommand (\"STARTTLS\\r\\n\", cancellationToken);\n\t\t\t\t\tif (response.StatusCode != SmtpStatusCode.ServiceReady)\n\t\t\t\t\t\tthrow new SmtpCommandException (SmtpErrorCode.UnexpectedStatusCode, response.StatusCode, response.Response);\n\n\t\t\t\t\ttry {\n\t\t\t\t\t\tvar tls = new ExtendedSslStream (stream, false, ValidateRemoteCertificate);\n\t\t\t\t\t\tStream.SetStream (tls);\n\n\t\t\t\t\t\tSslHandshake (tls, host, cancellationToken);\n\t\t\t\t\t} catch (Exception ex) {\n\t\t\t\t\t\tthrow SslHandshakeException.Create (ref sslValidationInfo, ex, true, \"SMTP\", host, port, 465, 25, 587);\n\t\t\t\t\t}\n\n\t\t\t\t\tsecure = true;\n\n\t\t\t\t\t// Send EHLO again and get the new list of supported extensions","sourceCodeStart":1351,"sourceCodeEnd":1387,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Net/Smtp/SmtpClient.cs#L1351-L1387","documentation":"Thrown in SmtpClient.Connect when SecureSocketOptions.StartTls is explicitly requested but the server's EHLO response does not advertise the STARTTLS capability. MailKit honors the caller's demand for opportunistic TLS and refuses to continue in plaintext rather than silently downgrading.","triggerScenarios":"Connect(host, port, SecureSocketOptions.StartTls) against a server that never offers STARTTLS — typically port 465 (implicit-SSL-only servers), port 25 relays with TLS disabled, or servers whose STARTTLS is hidden by policy.","commonSituations":"Using StartTls on port 465 (wrong pairing: 465 needs SslOnConnect); old/insecure mail servers without TLS support; firewalls/security appliances stripping the STARTTLS advertisement.","solutions":["Use SecureSocketOptions.SslOnConnect for port 465, and StartTls only for port 587.","Use SecureSocketOptions.Auto to let MailKit pick the right strategy from the port/capabilities.","After EHLO, check (client.Capabilities & SmtpCapabilities.StartTLS) before demanding StartTls, or accept plaintext if the capability is absent and your security policy allows it."],"exampleFix":"// before\nclient.Connect(\"smtp.example.com\", 465, SecureSocketOptions.StartTls); // NotSupportedException\n\n// after\nclient.Connect(\"smtp.example.com\", 465, SecureSocketOptions.SslOnConnect);","handlingStrategy":"validation","validationCode":"client.Connect(host, port, SecureSocketOptions.Auto); // or pick SslOnConnect for 465, StartTls for 587","typeGuard":null,"tryCatchPattern":"try {\n    client.Connect(host, 587, SecureSocketOptions.StartTls);\n} catch (NotSupportedException ex) {\n    // server lacks STARTTLS; either fail closed or retry with Auto per security policy\n    throw new SmtpTlsPolicyException(\"STARTTLS unavailable on server\", ex);\n}","preventionTips":["Pair ports with options: 465 → SslOnConnect, 587 → StartTls.","Prefer SecureSocketOptions.Auto unless you enforce a TLS policy.","Check client.Capabilities for SmtpCapabilities.StartTLS after connect."],"tags":["smtp","mailkit","starttls","tls"],"backgroundTag":"feature-not-enabled","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}