{"record":{"id":"3eb120e15ebb95cb","repo":"jstedfast/MailKit","slug":"failed-to-negotiate-authentication-method-with-the-proxy","errorCode":null,"errorMessage":"Failed to negotiate authentication method with the proxy server.","messagePattern":"Failed to negotiate authentication method with the proxy server\\.","errorType":"exception","errorClass":"ProxyProtocolException","httpStatus":null,"severity":"error","filePath":"MailKit/Net/Proxy/Socks5Client.cs","lineNumber":417,"sourceCode":"\t\t\tif (addrType == Socks5AddressType.Domain)\n\t\t\t\tdomain = Encoding.UTF8.GetBytes (host);\n\n\t\t\ttry {\n\t\t\t\tSocks5AuthMethod method;\n\n\t\t\t\tif (ProxyCredentials != null)\n\t\t\t\t\tmethod = NegotiateAuthMethod (socket, cancellationToken, Socks5AuthMethod.UserPassword, Socks5AuthMethod.Anonymous);\n\t\t\t\telse\n\t\t\t\t\tmethod = NegotiateAuthMethod (socket, cancellationToken, Socks5AuthMethod.Anonymous);\n\n\t\t\t\tswitch (method) {\n\t\t\t\tcase Socks5AuthMethod.UserPassword:\n\t\t\t\t\tAuthenticate (socket, cancellationToken);\n\t\t\t\t\tbreak;\n\t\t\t\tcase Socks5AuthMethod.Anonymous:\n\t\t\t\t\tbreak;\n\t\t\t\tdefault:\n\t\t\t\t\tthrow new ProxyProtocolException (\"Failed to negotiate authentication method with the proxy server.\");\n\t\t\t\t}\n\n\t\t\t\tvar buffer = GetConnectCommand (addrType, domain, ip, port, out int n);\n\n\t\t\t\tSend (socket, buffer, 0, n, cancellationToken);\n\n\t\t\t\t// +-----+-----+-------+------+----------+----------+\n\t\t\t\t// | VER | REP |  RSV  | ATYP | BND.ADDR | BND.PORT |\n\t\t\t\t// +-----+-----+-------+------+----------+----------+\n\t\t\t\t// |  1  |  1  | X'00' |  1   | Variable |    2     |\n\t\t\t\t// +-----+-----+-------+------+----------+----------+\n\n\t\t\t\t// Note: We know we'll need at least 4 bytes of header + a minimum of 1 byte\n\t\t\t\t// to determine the length of the BND.ADDR field if ATYP is a domain.\n\t\t\t\tint nread, need = 5;\n\t\t\t\tn = 0;\n\n\t\t\t\tdo {","sourceCodeStart":399,"sourceCodeEnd":435,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Net/Proxy/Socks5Client.cs#L399-L435","documentation":"MailKit's Socks5Client threw ProxyProtocolException because the SOCKS5 proxy did not accept any of the authentication methods the client offered during method negotiation. When no credentials are configured the client offers only Anonymous; with credentials it offers UserPassword plus Anonymous. If the server replies with 0xFF (no acceptable methods) or an unrecognized method byte, the negotiation switch falls to the default case and this exception is thrown.","triggerScenarios":"Calling Socks5Client.Connect() against a SOCKS5 proxy that requires username/password authentication while ProxyCredentials is null (so only Anonymous is offered), or against a proxy that uses an unsupported auth method (e.g. GSSAPI), or a non-SOCKS5 server on the proxy port returning a garbage reply.","commonSituations":"Connecting through a corporate SOCKS5 proxy that mandates authentication but instantiating Socks5Client(host, port) without a NetworkCredential; proxy server actually an HTTP proxy; wrong proxy port pointing at a different service.","solutions":["Create the Socks5Client with credentials: new Socks5Client(host, port, new NetworkCredential(user, pass)) so UserPassword is negotiated.","Verify the proxy is genuinely SOCKS5 and the host/port are correct (HTTP proxies will not speak the SOCKS5 handshake).","Check the proxy server's allowed auth methods (may need GSSAPI or IP allowlisting instead of user/pass).","Catch ProxyProtocolException and surface a clear configuration error to the user."],"exampleFix":"// before\nvar proxy = new Socks5Client(\"proxy.corp.com\", 1080);\n// after\nvar proxy = new Socks5Client(\"proxy.corp.com\", 1080, new NetworkCredential(\"proxyuser\", \"proxypass\"));","handlingStrategy":"try-catch","validationCode":"var proxy = proxyCredentials != null\n    ? new Socks5Client(proxyHost, proxyPort, proxyCredentials)\n    : new Socks5Client(proxyHost, proxyPort);\nif (proxyCredentials == null)\n    Console.WriteLine(\"Warning: no proxy credentials supplied; proxy must allow anonymous access\");","typeGuard":"bool IsSocks5ClientUsable(Socks5Client c) => c != null && !string.IsNullOrEmpty(c.ProxyHost) && c.ProxyPort > 0;","tryCatchPattern":"try {\n    var stream = proxy.Connect(host, port);\n} catch (ProxyProtocolException ex) {\n    // auth negotiation failed: proxy likely requires credentials or an unsupported method\n    throw new ApplicationException(\"SOCKS5 proxy authentication negotiation failed; check proxy credentials/type\", ex);\n}","preventionTips":["Always configure proxy credentials when the corporate proxy requires auth","Confirm the proxy scheme is socks5, not http, before choosing the client class","Test the proxy handshake with a tool like curl --socks5 before deploying"],"tags":["network","socks5","proxy","authentication"],"backgroundTag":"authentication-required","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}