jstedfast/MailKit · error · NotSupportedException

CRAM-MD5 does not support SASL-IR.

Error message

CRAM-MD5 does not support SASL-IR.

What it means

CRAM-MD5 is challenge/response: the client must wait for the server's challenge and cannot send initial data (SASL-IR). Calling Challenge with a null token (which represents initial-response mode) throws NotSupportedException.

Solutions

1. Do not advertise CRAM-MD5 on connections where SASL-IR is used; select a mechanism that supports IR (e.g. PLAIN, SCRAM-SHA-256) or let the server send its challenge first.
2. Configure the client/library layer to disable initial-response for CRAM-MD5.
3. If writing custom protocol code, pass the server's actual challenge bytes (never null) to Challenge().

Example fix

// before
client.Authenticate(saslUri, new SaslMechanismCramMd5(user, pass)); // client sends SASL-IR
// after
client.Authenticate(saslUri, new SaslMechanismScramSha256(user, pass)); // supports SASL-IR
// or disable initial response for the CRAM-MD5 path

// don't request SASL-IR for CRAM-MD5
bool supportsInitialResponse = mech is not SaslMechanismCramMd5;

try {
    client.Authenticate(uri, new SaslMechanismCramMd5(user, pass));
} catch (NotSupportedException) {
    client.Authenticate(uri, new SaslMechanismScramSha256(user, pass));
}

When it happens

Trigger: Using SaslMechanismCramMd5 with a protocol/server path that attempts SASL Initial Client Response (sending credentials with the AUTH command instead of waiting for '+ '), or directly calling Challenge(null, ...) in tests/custom code.

Common situations: Enabling SASL-IR in an IMAP/SMTP client implementation while negotiating CRAM-MD5, custom SASL drivers that optimistically send an initial response for every mechanism.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• DIGEST-MD5 does not support SASL-IR.
• The IMAP server does not support the STARTTLS extension.
• The IMAP server does not support the COMPRESS extension.
• MailKitLite does not support the COMPRESS extension.
• The IMAP server does not support the METADATA extension.

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/b4b4e83c7416696f. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Security/SaslMechanismCramMd5.cs:112

		/// </remarks>
		/// <returns>The next challenge response.</returns>
		/// <param name="token">The server's challenge token.</param>
		/// <param name="startIndex">The index into the token specifying where the server's challenge begins.</param>
		/// <param name="length">The length of the server's challenge.</param>
		/// <param name="cancellationToken">The cancellation token.</param>
		/// <exception cref="System.NotSupportedException">
		/// The SASL mechanism does not support SASL-IR.
		/// </exception>
		/// <exception cref="System.OperationCanceledException">
		/// The operation was canceled via the cancellation token.
		/// </exception>
		/// <exception cref="SaslException">
		/// An error has occurred while parsing the server's challenge token.
		/// </exception>
		protected override byte[]? Challenge (byte[]? token, int startIndex, int length, CancellationToken cancellationToken)
		{
			if (token == null)
				throw new NotSupportedException ("CRAM-MD5 does not support SASL-IR.");

			if (IsAuthenticated)
				return null;

			var userName = Encoding.UTF8.GetBytes (Credentials.UserName);
			var password = Encoding.UTF8.GetBytes (Credentials.Password);
			var ipad = new byte[64];
			var opad = new byte[64];
			byte[] digest, passwd;

			if (password.Length > 64) {
				using (var md5 = MD5.Create ())
					passwd = md5.ComputeHash (password);
			} else {
				passwd = password;
			}

			Array.Copy (passwd, ipad, passwd.Length);

View on GitHub (pinned to 9d3859a785)