jstedfast/MailKit · error · AuthenticationException

Failed to authenticate with SOCKS5 proxy server.

Error message

Failed to authenticate with SOCKS5 proxy server.

What it means

After sending the RFC 1929 username/password request, the synchronous Authenticate reads the 2-byte reply; any status byte other than 0x00 (Success) means the proxy rejected the credentials, so an AuthenticationException is thrown. Note the reply code itself is discarded — the message is intentionally generic.

Solutions

1. Verify the username/password against the proxy admin or provider dashboard and update ProxyCredentials
2. Test the same credentials with curl --socks5 -U user:pass to isolate client vs server
3. Check for credential rotation/secrets-manager drift; redeploy with current secrets

Example fix

// before
proxy.ProxyCredentials = new NetworkCredential(oldUser, oldPass);
proxy.Connect(uri);
// after
proxy.ProxyCredentials = new NetworkCredential(secrets["socks5:user"], secrets["socks5:pass"]); // refreshed
proxy.Connect(uri);

try {
    socks5.Connect(proxyHost, proxyPort, target, targetPort);
} catch (AuthenticationException) {
    log.Error("SOCKS5 credentials rejected for {0}:{1}", proxyHost, proxyPort);
    // alert ops: refresh credentials; do not retry blindly (proxy may lock account)
}

When it happens

Trigger: Socks5Client.Connect (sync) with ProxyCredentials whose username/password do not match an account the proxy accepts, or the proxy chose the username/password method but the server later rejects the values.

Common situations: Rotated or expired proxy credentials not updated in app config, wrong user for that proxy (multiple proxies), accounts locked by the proxy admin, or credentials for a different proxy environment (staging vs production).

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to negotiate authentication method with the proxy…
• Proxy server responded with unknown SOCKS version
• User name too long.
• Password too long.
• Failed to connect to

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/e231053fb11381ef. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Proxy/Socks5Client.cs:280

			return buffer;
		}

		void Authenticate (Socket socket, CancellationToken cancellationToken)
		{
			var buffer = GetAuthenticateCommand ();

			Send (socket, buffer, 0, buffer.Length, cancellationToken);

			int nread, n = 0;

			do {
				if ((nread = Receive (socket, buffer, 0 + n, 2 - n, cancellationToken)) > 0)
					n += nread;
			} while (n < 2);

			if (buffer[1] != (byte) Socks5Reply.Success)
				throw new AuthenticationException ("Failed to authenticate with SOCKS5 proxy server.");
		}

		async Task AuthenticateAsync (Socket socket, CancellationToken cancellationToken)
		{
			var buffer = GetAuthenticateCommand ();

			await SendAsync (socket, buffer, 0, buffer.Length, cancellationToken).ConfigureAwait (false);

			int nread, n = 0;

			do {
				if ((nread = await ReceiveAsync (socket, buffer, 0 + n, 2 - n, cancellationToken).ConfigureAwait (false)) > 0)
					n += nread;
			} while (n < 2);

			if (buffer[1] != (byte) Socks5Reply.Success)
				throw new AuthenticationException ("Failed to authenticate with SOCKS5 proxy server.");
		}

View on GitHub (pinned to 9d3859a785)