{"record":{"id":"cf6f054bf7626cda","repo":"jstedfast/MailKit","slug":"the-smtp-server-does-not-support-the-starttls-extension","errorCode":null,"errorMessage":"The SMTP server does not support the STARTTLS extension.","messagePattern":"The SMTP server does not support the STARTTLS extension\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"MailKit/Net/Smtp/AsyncSmtpClient.cs","lineNumber":456,"sourceCode":"\t\t\t\tstream.Dispose ();\n\t\t\t\tsecure = false;\n\t\t\t\tthrow;\n\t\t\t}\n\n\t\t\tStream = new SmtpStream (stream, ProtocolLogger);\n\n\t\t\ttry {\n\t\t\t\t// read the greeting\n\t\t\t\tvar response = await Stream.ReadResponseAsync (cancellationToken).ConfigureAwait (false);\n\n\t\t\t\tif (response.StatusCode != SmtpStatusCode.ServiceReady)\n\t\t\t\t\tthrow new SmtpCommandException (SmtpErrorCode.UnexpectedStatusCode, response.StatusCode, response.Response);\n\n\t\t\t\t// Send EHLO and get a list of supported extensions\n\t\t\t\tawait EhloAsync (true, cancellationToken).ConfigureAwait (false);\n\n\t\t\t\tif (options == SecureSocketOptions.StartTls && (capabilities & SmtpCapabilities.StartTLS) == 0)\n\t\t\t\t\tthrow new NotSupportedException (\"The SMTP server does not support the STARTTLS extension.\");\n\n\t\t\t\tif (starttls && (capabilities & SmtpCapabilities.StartTLS) != 0) {\n\t\t\t\t\tresponse = await Stream.SendCommandAsync (\"STARTTLS\\r\\n\", cancellationToken).ConfigureAwait (false);\n\t\t\t\t\tif (response.StatusCode != SmtpStatusCode.ServiceReady)\n\t\t\t\t\t\tthrow new SmtpCommandException (SmtpErrorCode.UnexpectedStatusCode, response.StatusCode, response.Response);\n\n\t\t\t\t\ttry {\n\t\t\t\t\t\tvar tls = new ExtendedSslStream (stream, false, ValidateRemoteCertificate);\n\t\t\t\t\t\tStream.SetStream (tls);\n\n\t\t\t\t\t\tawait SslHandshakeAsync (tls, host, cancellationToken).ConfigureAwait (false);\n\t\t\t\t\t} catch (Exception ex) {\n\t\t\t\t\t\tthrow SslHandshakeException.Create (ref sslValidationInfo, ex, true, \"SMTP\", host, port, 465, 25, 587);\n\t\t\t\t\t}\n\n\t\t\t\t\tsecure = true;\n\n\t\t\t\t\t// Send EHLO again and get the new list of supported extensions","sourceCodeStart":438,"sourceCodeEnd":474,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Net/Smtp/AsyncSmtpClient.cs#L438-L474","documentation":"During PostConnectAsync, when SecureSocketOptions.StartTls was requested, MailKit checks the EHLO capability list for SmtpCapabilities.StartTLS. If the server did not advertise STARTTLS, it throws NotSupportedException, refusing to proceed on an unencrypted channel because the caller explicitly demanded TLS upgrade.","triggerScenarios":"Calling ConnectAsync with options=SecureSocketOptions.StartTls against a server that (a) does not support STARTTLS, or (b) already runs implicit TLS on that port (e.g. port 465) so it never advertises STARTTLS.","commonSituations":"Using StartTls on port 465 (implicit TLS) instead of 587 (plaintext+STARTTLS); old/locked-down relays without TLS support.","solutions":["Use SecureSocketOptions.StartTls on port 587; use SecureSocketOptions.SslOnConnect for port 465.","Or use SecureSocketOptions.Auto to let MailKit pick the right strategy.","Verify the server supports STARTTLS via the EHLO capability list (client.Capabilities).","Enable STARTTLS support on the SMTP server if you control it."],"exampleFix":"// before\nawait client.ConnectAsync(\"smtp.example.com\", 465, SecureSocketOptions.StartTls);\n// after\nawait client.ConnectAsync(\"smtp.example.com\", 465, SecureSocketOptions.SslOnConnect); // 465 is implicit TLS\n// (or port 587 + SecureSocketOptions.StartTls)","handlingStrategy":"validation","validationCode":"// choose options based on port before calling ConnectAsync\nSecureSocketOptions options = port == 465\n    ? SecureSocketOptions.SslOnConnect\n    : SecureSocketOptions.StartTls;\n// or simply:\noptions = SecureSocketOptions.Auto;","typeGuard":"bool SupportsStartTls(SmtpClient c) => c.IsConnected && c.Capabilities.HasFlag(SmtpCapabilities.StartTLS);","tryCatchPattern":"try {\n    await client.ConnectAsync(host, port, SecureSocketOptions.StartTls);\n} catch (NotSupportedException ex) when (ex.Message.Contains(\"STARTTLS\")) {\n    // fall back to implicit TLS or Auto\n    await client.ConnectAsync(host, 465, SecureSocketOptions.SslOnConnect);\n}","preventionTips":["Use port 587 + StartTls, or port 465 + SslOnConnect; or just SecureSocketOptions.Auto","Never assume a relay supports STARTTLS; check the EHLO capabilities","Enable TLS support on the server if you control it"],"tags":["smtp","tls","starttls","async"],"backgroundTag":"tls-not-supported","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}