{"record":{"id":"f18cccc246068176","repo":"semaphoreui/semaphore","slug":"wrong-host-name","errorCode":null,"errorMessage":"wrong host name","messagePattern":"wrong host name","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/mailer/auth.go","lineNumber":36,"sourceCode":"\ntype plainOrLoginAuth struct {\n\tusername   string\n\tpassword   string\n\thost       string\n\tauthMethod string\n}\n\nfunc (a *plainOrLoginAuth) Start(server *smtp.ServerInfo) (string, []byte, error) {\n\t// Must have TLS, or else localhost server.\n\t// Note: If TLS is not true, then we can't trust ANYTHING in ServerInfo.\n\t// In particular, it doesn't matter if the server advertises PLAIN auth.\n\t// That might just be the attacker saying\n\t// \"it's ok, you can trust me with your password.\"\n\tif !server.TLS && !isLocalhost(server.Name) {\n\t\treturn \"\", nil, errors.New(\"unencrypted connection\")\n\t}\n\tif server.Name != a.host {\n\t\treturn \"\", nil, errors.New(\"wrong host name\")\n\t}\n\tif !slices.Contains(server.Auth, \"PLAIN\") {\n\t\ta.authMethod = \"LOGIN\"\n\t\treturn a.authMethod, nil, nil\n\t} else {\n\t\ta.authMethod = \"PLAIN\"\n\t\tresp := []byte(\"\\x00\" + a.username + \"\\x00\" + a.password)\n\t\treturn a.authMethod, resp, nil\n\t}\n}\n\nfunc (a *plainOrLoginAuth) Next(fromServer []byte, more bool) ([]byte, error) {\n\tif !more {\n\t\treturn nil, nil\n\t}\n\n\tif a.authMethod == \"PLAIN\" {\n\t\t// We've already sent everything.","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/util/mailer/auth.go#L18-L54","documentation":"After the TLS check, PLAIN auth verifies that the smtp.ServerInfo.Name (the hostname the client connected to) matches the host the plainAuth was created with. A mismatch means the credentials could be sent to a different server than intended, so Start aborts with 'wrong host name'.","triggerScenarios":"The smtp.Client connection's server name differs from the host passed to plainAuth - e.g. connecting via IP address or alias while auth was built with the FQDN, or a hostname change in config without updating the auth setup.","commonSituations":"SMTP config uses 'mail.example.com' but connection established to an IP or 'smtp.example.com'; DNS aliases/CNAMEs; load balancer endpoints; host renamed during a migration.","solutions":["Make the mailer SMTP host config exactly match the hostname used for the connection (same string, no alias vs FQDN mismatch).","Connect using the same host value that is passed to plainAuth instead of an IP address.","Update DNS/aliases or the configured host after infrastructure renames so both sides agree."],"exampleFix":"// before\nclient, _ := smtp.Dial(\"10.0.0.5:587\")            // ServerInfo.Name = \"10.0.0.5\"\na := mailer.PlainAuth(\"\", user, pass, \"smtp.example.com\")\n// after\nclient, _ := smtp.Dial(\"smtp.example.com:587\")    // names now match\na := mailer.PlainAuth(\"\", user, pass, \"smtp.example.com\")","handlingStrategy":"validation","validationCode":"if serverName != smtpConfig.Host {\n    return fmt.Errorf(\"connection server name %q does not match configured SMTP host %q\", serverName, smtpConfig.Host)\n}","typeGuard":null,"tryCatchPattern":"ok, enc, err := auth.Start(&serverInfo)\nif err != nil && err.Error() == \"wrong host name\" {\n    return fmt.Errorf(\"connect with the same hostname passed to PlainAuth (no IP/alias mismatch): %w\", err)\n}","preventionTips":["Dial the SMTP server using the exact hostname string configured for auth - never an IP or alias.","Update SMTP host config together with DNS/infrastructure renames.","Prefer canonical FQDNs over CNAMEs in SMTP configuration.","Log ServerInfo.Name when debugging SMTP auth failures."],"tags":["smtp","hostname","email","tls"],"backgroundTag":"invalid-config-value","analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}