{"record":{"id":"743b15424b9a5907","repo":"jstedfast/MailKit","slug":"the-pop3-server-does-not-support-the-stls-extension","errorCode":null,"errorMessage":"The POP3 server does not support the STLS extension.","messagePattern":"The POP3 server does not support the STLS extension\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"MailKit/Net/Pop3/AsyncPop3Client.cs","lineNumber":329,"sourceCode":"\t\t{\n\t\t\tprobed = ProbedCapabilities.None;\n\n\t\t\ttry {\n\t\t\t\tProtocolLogger.LogConnect (engine.Uri!);\n\t\t\t} catch {\n\t\t\t\tstream.Dispose ();\n\t\t\t\tthrow;\n\t\t\t}\n\n\t\t\tvar pop3 = new Pop3Stream (stream, ProtocolLogger);\n\n\t\t\tawait engine.ConnectAsync (pop3, cancellationToken).ConfigureAwait (false);\n\n\t\t\ttry {\n\t\t\t\tawait engine.QueryCapabilitiesAsync (cancellationToken).ConfigureAwait (false);\n\n\t\t\t\tif (options == SecureSocketOptions.StartTls && (engine.Capabilities & Pop3Capabilities.StartTLS) == 0)\n\t\t\t\t\tthrow new NotSupportedException (\"The POP3 server does not support the STLS extension.\");\n\n\t\t\t\tif (starttls && (engine.Capabilities & Pop3Capabilities.StartTLS) != 0) {\n\t\t\t\t\tawait SendCommandAsync (cancellationToken, \"STLS\\r\\n\").ConfigureAwait (false);\n\n\t\t\t\t\ttry {\n\t\t\t\t\t\tvar tls = new ExtendedSslStream (stream, false, ValidateRemoteCertificate);\n\t\t\t\t\t\tpop3.SetStream (tls);\n\n\t\t\t\t\t\tawait SslHandshakeAsync (tls, host, cancellationToken).ConfigureAwait (false);\n\t\t\t\t\t} catch (Exception ex) {\n\t\t\t\t\t\tthrow SslHandshakeException.Create (ref sslValidationInfo, ex, true, \"POP3\", host, port, 995, 110);\n\t\t\t\t\t}\n\n\t\t\t\t\tengine.IsSecure = true;\n\n\t\t\t\t\t// re-issue a CAPA command\n\t\t\t\t\tawait engine.QueryCapabilitiesAsync (cancellationToken).ConfigureAwait (false);\n\t\t\t\t}","sourceCodeStart":311,"sourceCodeEnd":347,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Net/Pop3/AsyncPop3Client.cs#L311-L347","documentation":"In Pop3Client.PostConnectAsync, when SecureSocketOptions.StartTls is explicitly requested, MailKit checks the server's CAPA response for the StartTLS capability. If the server does not advertise STLS, it throws NotSupportedException because the requested TLS negotiation strategy cannot be honored.","triggerScenarios":"client.ConnectAsync(host, port, SecureSocketOptions.StartTls) against a POP3 server that lacks the STLS capability (e.g. plain server without TLS support, or capability detection disabled).","commonSituations":"Configuring StartTls when the server only supports implicit TLS (port 995) or no TLS at all; self-hosted/minimal POP3 servers without STLS; misremembering the port (995 = implicit SSL, 110 = plain/STARTTLS).","solutions":["Use SecureSocketOptions.SslOnConnect for implicit TLS on port 995, or Auto to let MailKit negotiate what the server supports.","Verify the server actually supports STLS: connect and inspect client.Capabilities for the StartTLS flag.","If TLS is genuinely unavailable, use SecureSocketOptions.None only on a trusted network (avoid sending credentials in plaintext)."],"exampleFix":"// before\nawait client.ConnectAsync(\"pop.example.com\", 110, SecureSocketOptions.StartTls);\n\n// after\n// server only supports implicit TLS on 995\nawait client.ConnectAsync(\"pop.example.com\", 995, SecureSocketOptions.SslOnConnect);\n// or negotiate automatically:\nawait client.ConnectAsync(\"pop.example.com\", 110, SecureSocketOptions.Auto);","handlingStrategy":"validation","validationCode":"// after connect, before relying on StartTls:\nif ((client.Capabilities & Pop3Capabilities.StartTLS) == 0)\n    throw new InvalidOperationException(\"POP3 server does not support STLS; use implicit TLS on port 995\");","typeGuard":null,"tryCatchPattern":"try { await client.ConnectAsync(host, port, SecureSocketOptions.StartTls); }\ncatch (NotSupportedException) {\n    await client.ConnectAsync(host, 995, SecureSocketOptions.SslOnConnect);\n}","preventionTips":["Use SecureSocketOptions.Auto or SslOnConnect instead of hard-coding StartTls","Know your server's TLS mode: 995 = implicit SSL, 110 = plain or STLS if advertised","Inspect client.Capabilities after connecting to confirm StartTLS support"],"tags":["pop3","tls","starttls","unsupported-feature","mailkit"],"backgroundTag":"unsupported-operation","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}