{"record":{"id":"881ea031562a7043","repo":"jstedfast/MailKit","slug":"the-pop3-server-does-not-support-the-stls-extension-881ea0","errorCode":null,"errorMessage":"The POP3 server does not support the STLS extension.","messagePattern":"The POP3 server does not support the STLS extension\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"MailKit/Net/Pop3/Pop3Client.cs","lineNumber":1132,"sourceCode":"\t\t{\n\t\t\tprobed = ProbedCapabilities.None;\n\n\t\t\ttry {\n\t\t\t\tProtocolLogger.LogConnect (engine.Uri!);\n\t\t\t} catch {\n\t\t\t\tstream.Dispose ();\n\t\t\t\tthrow;\n\t\t\t}\n\n\t\t\tvar pop3 = new Pop3Stream (stream, ProtocolLogger);\n\n\t\t\tengine.Connect (pop3, cancellationToken);\n\n\t\t\ttry {\n\t\t\t\tengine.QueryCapabilities (cancellationToken);\n\n\t\t\t\tif (options == SecureSocketOptions.StartTls && (engine.Capabilities & Pop3Capabilities.StartTLS) == 0)\n\t\t\t\t\tthrow new NotSupportedException (\"The POP3 server does not support the STLS extension.\");\n\n\t\t\t\tif (starttls && (engine.Capabilities & Pop3Capabilities.StartTLS) != 0) {\n\t\t\t\t\tSendCommand (cancellationToken, \"STLS\\r\\n\");\n\n\t\t\t\t\ttry {\n\t\t\t\t\t\tvar tls = new ExtendedSslStream (stream, false, ValidateRemoteCertificate);\n\t\t\t\t\t\tpop3.SetStream (tls);\n\n\t\t\t\t\t\tSslHandshake (tls, host, cancellationToken);\n\t\t\t\t\t} catch (Exception ex) {\n\t\t\t\t\t\tthrow SslHandshakeException.Create (ref sslValidationInfo, ex, true, \"POP3\", host, port, 995, 110);\n\t\t\t\t\t}\n\n\t\t\t\t\tengine.IsSecure = true;\n\n\t\t\t\t\t// re-issue a CAPA command\n\t\t\t\t\tengine.QueryCapabilities (cancellationToken);\n\t\t\t\t}","sourceCodeStart":1114,"sourceCodeEnd":1150,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Net/Pop3/Pop3Client.cs#L1114-L1150","documentation":"MailKit's Pop3Client.Connect throws this NotSupportedException when an explicit SecureSocketOptions.StartTls was requested, but the POP3 server did not advertise the STLS capability in its CAPA response. The library refuses to proceed because it cannot upgrade the connection to TLS as demanded. It is a capability-negotiation failure, not a network or certificate problem.","triggerScenarios":"Calling Pop3Client.Connect with options: SecureSocketOptions.StartTls against a POP3 server whose CAPA output lacks the STLS capability (e.g. a plaintext POP3 server on port 110 with no TLS support, or one that only supports implicit TLS on port 995).","commonSituations":"Configuring a mail client for STARTTLS against an old or misconfigured POP3 server; connecting to port 995 (implicit TLS) with StartTls instead of SslOnConnect; corporate/ISP servers that dropped STLS support; server behind a proxy that strips capabilities.","solutions":["Use SecureSocketOptions.SslOnConnect and connect to port 995 if the server supports implicit TLS.","Fall back to SecureSocketOptions.None (or Auto) if plaintext is acceptable, or upgrade the POP3 server to support STLS.","Verify the server's capabilities with 'CAPA' (telnet/openssl s_client) to confirm STLS is advertised.","Point the client at a different host/port where TLS is actually offered."],"exampleFix":"// before\nclient.Connect (\"pop.example.com\", 110, SecureSocketOptions.StartTls);\n// after\nclient.Connect (\"pop.example.com\", 995, SecureSocketOptions.SslOnConnect);","handlingStrategy":"validation","validationCode":"// After connecting with Auto/None or before choosing options, inspect capabilities\nclient.Connect (host, port, SecureSocketOptions.Auto, cancellationToken);\nbool stlsAvailable = client.Capabilities.HasFlag (Pop3Capabilities.StartTLS);\nif (!stlsAvailable) throw new InvalidOperationException (\"Server lacks STLS; use port 995 / SslOnConnect.\");","typeGuard":null,"tryCatchPattern":"try {\n    client.Connect (host, 110, SecureSocketOptions.StartTls, cancellationToken);\n} catch (NotSupportedException) {\n    client.Connect (host, 995, SecureSocketOptions.SslOnConnect, cancellationToken);\n}","preventionTips":["Prefer implicit TLS (port 995, SslOnConnect) over STARTTLS whenever possible","Verify server CAPA output with openssl s_client or telnet before configuring clients","Use SecureSocketOptions.Auto to let MailKit negotiate the best available option"],"tags":["pop3","tls","starttls","mailkit","capability-negotiation"],"backgroundTag":"feature-not-enabled","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}