jstedfast/MailKit · error · NotSupportedException

No compatible authentication mechanisms found.

Error message

No compatible authentication mechanisms found.

What it means

During the AUTH handshake MailKit iterates its enabled SaslAuthenticationMechanisms filtered against the mechanisms the server advertised; if every enabled mechanism was rejected or none overlap with the server's list, no attempt succeeded and 'tried' stays false, so it throws NotSupportedException("No compatible authentication mechanisms found.").

Solutions

1. Inspect client.AuthenticationMechanisms after Connect and enable (add back) the mechanisms the server supports.
2. Use a TLS-protected connection (STARTTLS/SSL) so the server will advertise PLAIN/LOGIN.
3. Pass an explicit SaslMechanism (e.g. new SaslMechanismLogin(user, pass) or SaslMechanismNtlm) that matches a server-advertised mechanism.
4. If the server only offers unsupported mechanisms (GSSAPI/Kerberos), configure the server or use an alternate auth path (e.g. OAuth2 via SaslMechanismOAuth2).

Example fix

// before
var client = new SmtpClient();
client.AuthenticationMechanisms.Clear(); // no mechanisms left
client.Connect(host, 587, SecureSocketOptions.StartTls);
client.Authenticate(user, pass); // NotSupportedException

// after
var client = new SmtpClient(new ProtocolLogger(Console.OpenStandardError()));
client.Connect(host, 587, SecureSocketOptions.StartTls);
foreach (var mech in client.AuthenticationMechanisms)
    Console.WriteLine(mech); // verify overlap with server list
client.Authenticate(user, pass);

var supported = client.AuthenticationMechanisms;
if (supported.Count == 0)
    throw new InvalidOperationException("Server advertised no AUTH mechanisms.");

try {
    client.Authenticate(user, pass);
} catch (NotSupportedException ex) {
    // log client.AuthenticationMechanisms and adjust enabled mechanisms
    throw new MailAuthConfigurationException("No overlapping SASL mechanisms", ex);
}

When it happens

Trigger: Server advertises only AUTH mechanisms that are disabled in client.AuthenticationMechanisms (or vice versa), e.g. server offers only CRAM-SHA256/GSSAPI while the client enables only PLAIN/LOGIN, or the developer removed mechanisms from client.AuthenticationMechanisms.

Common situations: Hardened SMTP servers disabling PLAIN/LOGIN over unencrypted links; Windows environments expecting GSSAPI/NTLM support MailKit doesn't ship; custom mechanism lists configured for a different server.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Value cannot be null. (Parameter 'message')
• Value cannot be null. (Parameter 'response')
• No compatible authentication mechanisms found.
• The SmtpClient must be connected before you can…
• The SmtpClient is already authenticated.

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/b5e04e2fad395a8c. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Smtp/SmtpClient.cs:1277

						OnAuthenticated (response.Response);
						return;
					}

					var message = string.Format (CultureInfo.InvariantCulture, "{0}: {1}", (int) response.StatusCode, response.Response);
					Exception inner;

					if (saslException != null)
						inner = new SmtpCommandException (SmtpErrorCode.UnexpectedStatusCode, response.StatusCode, response.Response, saslException);
					else
						inner = new SmtpCommandException (SmtpErrorCode.UnexpectedStatusCode, response.StatusCode, response.Response);

					authException = new AuthenticationException (message, inner);
				}

				if (tried)
					throw authException ?? new AuthenticationException ();

				throw new NotSupportedException ("No compatible authentication mechanisms found.");
			} catch (Exception ex) {
				operation.SetError (ex);
				throw;
			}
		}

		internal static void ComputeDefaultValues (string host, ref int port, ref SecureSocketOptions options, out Uri uri, out bool starttls)
		{
			switch (options) {
			default:
				if (port == 0)
					port = 25;
				break;
			case SecureSocketOptions.Auto:
				switch (port) {
				case 0: port = 25; goto default;
				case 465: options = SecureSocketOptions.SslOnConnect; break;
				default: options = SecureSocketOptions.StartTlsWhenAvailable; break;

View on GitHub (pinned to 9d3859a785)