{"record":{"id":"cfa6dfe294e3e097","repo":"jstedfast/MailKit","slug":"the-imap-server-does-not-support-the-starttls-extension-cfa6df","errorCode":null,"errorMessage":"The IMAP server does not support the STARTTLS extension.","messagePattern":"The IMAP server does not support the STARTTLS extension\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"MailKit/Net/Imap/ImapClient.cs","lineNumber":1482,"sourceCode":"\n\t\t\tconnecting = true;\n\n\t\t\tvar imap = new ImapStream (stream, ProtocolLogger);\n\n\t\t\ttry {\n\t\t\t\tengine.Connect (imap, cancellationToken);\n\t\t\t} catch {\n\t\t\t\tconnecting = false;\n\t\t\t\tthrow;\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\t// Only query the CAPABILITIES if the greeting didn't include them.\n\t\t\t\tif (engine.CapabilitiesVersion == 0)\n\t\t\t\t\tengine.QueryCapabilities (cancellationToken);\n\n\t\t\t\tif (options == SecureSocketOptions.StartTls && (engine.Capabilities & ImapCapabilities.StartTLS) == 0)\n\t\t\t\t\tthrow new NotSupportedException (\"The IMAP server does not support the STARTTLS extension.\");\n\n\t\t\t\tif (starttls && (engine.Capabilities & ImapCapabilities.StartTLS) != 0) {\n\t\t\t\t\tvar ic = engine.QueueCommand (cancellationToken, null, \"STARTTLS\\r\\n\");\n\n\t\t\t\t\tengine.Run (ic);\n\n\t\t\t\t\tif (ic.Response == ImapCommandResponse.Ok) {\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tvar tls = new ExtendedSslStream (stream, false, ValidateRemoteCertificate);\n\t\t\t\t\t\t\timap.SetStream (tls);\n\n\t\t\t\t\t\t\tSslHandshake (tls, host, cancellationToken);\n\t\t\t\t\t\t} catch (Exception ex) {\n\t\t\t\t\t\t\tthrow SslHandshakeException.Create (ref sslValidationInfo, ex, true, \"IMAP\", host, port, 993, 143);\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tengine.IsSecure = true;\n","sourceCodeStart":1464,"sourceCodeEnd":1500,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Net/Imap/ImapClient.cs#L1464-L1500","documentation":"Thrown as NotSupportedException when SecureSocketOptions.StartTls was requested but the server's CAPABILITIES response does not advertise the STARTTLS capability, meaning the server offers no way to upgrade a plaintext connection to TLS.","triggerScenarios":"Calling Connect(host, port, SecureSocketOptions.StartTls) against a server whose CAPABILITIES lack STARTTLS; connecting to port 993 (implicit TLS) while explicitly requesting StartTls.","commonSituations":"Misconfigured port (993 implicit-SSL server probed with STARTTLS); old or hardened servers that only allow implicit TLS; corporate mail server with TLS-on-connect only.","solutions":["Use SecureSocketOptions.SslOnConnect with port 993 instead of StartTls","Verify the server actually advertises STARTTLS (openssl s_client -starttls imap)","Use SecureSocketOptions.Auto to let MailKit negotiate the best available option","Enable STARTTLS on the IMAP server if you administer it"],"exampleFix":"// before\nclient.Connect(\"imap.example.com\", 993, SecureSocketOptions.StartTls);\n// after\nclient.Connect(\"imap.example.com\", 993, SecureSocketOptions.SslOnConnect);","handlingStrategy":"fallback","validationCode":"client.ConnectProbe(host, port); // then inspect advertised caps, or try Auto first","typeGuard":null,"tryCatchPattern":"try { client.Connect(host, port, SecureSocketOptions.StartTls); }\ncatch (NotSupportedException) { client.Connect(host, 993, SecureSocketOptions.SslOnConnect); }","preventionTips":["Prefer SecureSocketOptions.Auto unless you know the server's TLS mode","Match option to port: 993 = SslOnConnect, 143 = StartTls/Auto","Test with openssl s_client -starttls imap when in doubt"],"tags":["imap","tls","starttls","mailkit"],"backgroundTag":"operation-not-supported","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}