jstedfast/MailKit · error · ArgumentException

The address cannot contain newline characters.

Error message

The address cannot contain newline characters.

What it means

SmtpClient.Verify/CreateVerifyCommand throws ArgumentException when the address contains newline characters (CR/LF). Newlines would let an attacker smuggle additional SMTP commands (VRFY injection), so the library explicitly rejects addresses containing them.

Solutions

1. Trim and strip CR/LF from the address before calling Verify
2. Validate the address against a strict email pattern (which excludes newlines) before the call
3. Reject newline-containing input at the application boundary as a validation error

Example fix

// before
await smtpClient.VerifyAsync(lineFromCsv); // may end with \n
// after
var addr = lineFromCsv?.Trim('\r', '\n').Trim();
if (!string.IsNullOrEmpty(addr) && !addr.Contains('\n') && !addr.Contains('\r'))
    await smtpClient.VerifyAsync(addr);

if (address == null || address.IndexOfAny(new[] {'\r','\n'}) != -1)
    throw new ArgumentException("Address must not contain newlines", nameof(address));
await smtpClient.VerifyAsync(address);

bool IsSafeAddress(string a) =>
    !string.IsNullOrEmpty(a) && a.IndexOfAny(new[] {'\r','\n'}) == -1;

try {
    var result = await smtpClient.VerifyAsync(address);
} catch (ArgumentException) {
    logger.LogWarning("VRFY address contained newlines (possible injection)");
}

When it happens

Trigger: Passing an address containing '\r' or '\n', e.g. from untrusted request input, multi-line text pasted into a form, or CSV/file data not stripped of line endings.

Common situations: Email harvested from raw file lines without trimming the trailing newline; attackers probing for SMTP header/command injection; log-derived addresses including separators.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• The alias cannot contain newline characters.
• The address cannot be empty.
• The alias cannot be empty.
• data
• InvalidChallenge

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/7c81a4bdf77d5ac8. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Smtp/SmtpClient.cs:2765

		/// An SMTP protocol exception occurred.
		/// </exception>
		public InternetAddressList Expand (string alias, CancellationToken cancellationToken = default)
		{
			var response = SendCommandInternal (CreateExpandCommand (alias), cancellationToken);

			return ParseExpandResponse (response);
		}

		string CreateVerifyCommand (string address)
		{
			if (address == null)
				throw new ArgumentNullException (nameof (address));

			if (address.Length == 0)
				throw new ArgumentException ("The address cannot be empty.", nameof (address));

			if (address.IndexOfAny (NewLineCharacters) != -1)
				throw new ArgumentException ("The address cannot contain newline characters.", nameof (address));

			CheckDisposed ();

			if (!IsConnected)
				throw new ServiceNotConnectedException ("The SmtpClient is not connected.");

			return string.Format ("VRFY {0}\r\n", address);
		}

		static MailboxAddress ParseVerifyResponse (SmtpResponse response)
		{
			if (response.StatusCode == SmtpStatusCode.Ok)
				return MailboxAddress.Parse (response.Response);

			throw new SmtpCommandException (SmtpErrorCode.UnexpectedStatusCode, response.StatusCode, response.Response);
		}

		/// <summary>

View on GitHub (pinned to 9d3859a785)