jstedfast/MailKit · error · ProxyProtocolException

Proxy server returned unknown address type.

Error message

Proxy server returned unknown address type.

What it means

The final CONNECT reply includes BND.ADDR whose type byte (ATYP) must be 1 (IPv4), 3 (domain), or 4 (IPv6). If ProcessPartialConnectResponse sees any other value the response is malformed per RFC 1928, and a ProxyProtocolException is thrown rather than misparsing the remaining bytes.

Solutions

1. Verify the endpoint is a compliant SOCKS5 server (test with curl --socks5) and upgrade/replace buggy proxy software
2. Ensure the socket stream is not shared/desynchronized (no prior reads from the stream by other code)
3. Capture the raw reply bytes for the proxy vendor; apply vendor patches or use a different SOCKS5 implementation

try {
    await socks5.ConnectAsync(proxyHost, proxyPort, target, targetPort);
} catch (ProxyProtocolException ex) when (ex.Message.Contains("unknown address type")) {
    log.Error("Malformed SOCKS5 reply from {0}:{1} — proxy not RFC 1928 compliant", proxyHost, proxyPort);
    // escalate to proxy vendor / fail over to backup proxy
}

When it happens

Trigger: Socks5Client.Connect/ConnectAsync receiving a corrupt or non-conformant CONNECT reply from the proxy — buggy/rogue proxy software, response stream desynchronized, or a non-SOCKS5 device answering.

Common situations: Intercepting middleboxes or broken proxy firmware, reading a response from the wrong server (TLS/plain mixup), or a proxy with a known protocol-implementation bug.

Related errors

• Proxy server responded with unknown SOCKS version
• Failed to authenticate with SOCKS5 proxy server.
• Failed to connect to
• Failed to negotiate authentication method with the proxy…
• The IMAP server unexpectedly refused the connection.

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/8462b655acf594b8. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Proxy/Socks5Client.cs:357

		int ProcessPartialConnectResponse (string host, int port, byte[] buffer)
		{
			VerifySocksVersion (buffer[0]);

			if (buffer[1] != (byte) Socks5Reply.Success)
				throw new ProxyProtocolException (string.Format (CultureInfo.InvariantCulture, "Failed to connect to {0}:{1}: {2}", host, port, GetFailureReason (buffer[1])));

			// +-----+-----+-------+------+----------+----------+
			// | VER | REP |  RSV  | ATYP | BND.ADDR | BND.PORT |
			// +-----+-----+-------+------+----------+----------+
			// |  1  |  1  | X'00' |  1   | Variable |    2     |
			// +-----+-----+-------+------+----------+----------+
			var addrType = (Socks5AddressType) buffer[3];

			switch (addrType) {
			case Socks5AddressType.Domain: return 4 + 1 + buffer[4] + 2;
			case Socks5AddressType.IPv6: return 4 + 16 + 2;
			case Socks5AddressType.IPv4: return 4 + 4 + 2;
			default: throw new ProxyProtocolException ("Proxy server returned unknown address type.");
			}
		}

		/// <summary>
		/// Connect to the target host.
		/// </summary>
		/// <remarks>
		/// Connects to the target host and port through the proxy server.
		/// </remarks>
		/// <returns>The connected network stream.</returns>
		/// <param name="host">The host name of the target server.</param>
		/// <param name="port">The target server port.</param>
		/// <param name="cancellationToken">The cancellation token.</param>
		/// <exception cref="System.ArgumentNullException">
		/// <paramref name="host"/> is <see langword="null" />.
		/// </exception>
		/// <exception cref="System.ArgumentOutOfRangeException">
		/// <paramref name="port"/> is not between <c>0</c> and <c>65535</c>.

View on GitHub (pinned to 9d3859a785)