jstedfast/MailKit · error · ArgumentException

The alias cannot contain newline characters.

Error message

The alias cannot contain newline characters.

What it means

SmtpClient.Expand/CreateExpandCommand throws ArgumentException when the alias contains newline characters (CR or LF). Newlines in an SMTP command enable command injection (smuggling extra SMTP verbs), so the library explicitly rejects any alias containing them.

Solutions

1. Strip or reject newline characters before calling Expand (alias.Replace("\r","").Replace("\n",""))
2. Validate the alias against a safe pattern (e.g. letters, digits, dots, dashes) before the call
3. Treat newline-containing input as a validation error at the application boundary

Example fix

// before
await smtpClient.ExpandAsync(userInput); // may contain newlines
// after
var alias = userInput?.Replace("\r", "").Replace("\n", "").Trim();
if (!string.IsNullOrEmpty(alias))
    await smtpClient.ExpandAsync(alias);

if (alias == null || alias.IndexOfAny(new[] {'\r','\n'}) != -1)
    throw new ArgumentException("Alias must not contain newlines", nameof(alias));
await smtpClient.ExpandAsync(alias);

bool IsSafeAlias(string a) =>
    !string.IsNullOrEmpty(a) && a.IndexOfAny(new[] {'\r','\n'}) == -1;

try {
    var list = await smtpClient.ExpandAsync(alias);
} catch (ArgumentException) {
    logger.LogWarning("EXPN alias contained newline characters (possible injection)");
}

When it happens

Trigger: Passing an alias that contains '\n' or '\r', typically from multi-line user input, untrusted request data, or log/text files parsed without newline stripping.

Common situations: Copying an alias from a text file/email body including a trailing newline; accepting raw multi-line form input; security scanners flagging injection risk when newline validation is bypassed.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• The address cannot contain newline characters.
• The address cannot be empty.
• The alias cannot be empty.
• data
• InvalidChallenge

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/403b91123dc901a0. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Smtp/SmtpClient.cs:2684

		public override string Send (FormatOptions options, MimeMessage message, MailboxAddress sender, IEnumerable<MailboxAddress> recipients, CancellationToken cancellationToken = default, ITransferProgress? progress = null)
		{
			var rcpts = ValidateArguments (options, message, sender, recipients);

			return Send (options, message, sender, rcpts, cancellationToken, progress);
		}

		#endregion

		string CreateExpandCommand (string alias)
		{
			if (alias == null)
				throw new ArgumentNullException (nameof (alias));

			if (alias.Length == 0)
				throw new ArgumentException ("The alias cannot be empty.", nameof (alias));

			if (alias.IndexOfAny (NewLineCharacters) != -1)
				throw new ArgumentException ("The alias cannot contain newline characters.", nameof (alias));

			CheckDisposed ();

			if (!IsConnected)
				throw new ServiceNotConnectedException ("The SmtpClient is not connected.");

			return string.Format ("EXPN {0}\r\n", alias);
		}

		static InternetAddressList ParseExpandResponse (SmtpResponse response)
		{
			if (response.StatusCode != SmtpStatusCode.Ok)
				throw new SmtpCommandException (SmtpErrorCode.UnexpectedStatusCode, response.StatusCode, response.Response);

			var lines = response.Response.Split ('\n');
			var list = new InternetAddressList ();

			for (int i = 0; i < lines.Length; i++) {

View on GitHub (pinned to 9d3859a785)