jstedfast/MailKit · error · NotSupportedException

The IMAP server does not support the STARTTLS extension.

Error message

The IMAP server does not support the STARTTLS extension.

What it means

Thrown as NotSupportedException when SecureSocketOptions.StartTls was requested but the server's CAPABILITIES response does not advertise the STARTTLS capability, meaning the server offers no way to upgrade a plaintext connection to TLS.

Solutions

1. Use SecureSocketOptions.SslOnConnect with port 993 instead of StartTls
2. Verify the server actually advertises STARTTLS (openssl s_client -starttls imap)
3. Use SecureSocketOptions.Auto to let MailKit negotiate the best available option
4. Enable STARTTLS on the IMAP server if you administer it

Example fix

// before
client.Connect("imap.example.com", 993, SecureSocketOptions.StartTls);
// after
client.Connect("imap.example.com", 993, SecureSocketOptions.SslOnConnect);

client.ConnectProbe(host, port); // then inspect advertised caps, or try Auto first

try { client.Connect(host, port, SecureSocketOptions.StartTls); }
catch (NotSupportedException) { client.Connect(host, 993, SecureSocketOptions.SslOnConnect); }

When it happens

Trigger: Calling Connect(host, port, SecureSocketOptions.StartTls) against a server whose CAPABILITIES lack STARTTLS; connecting to port 993 (implicit TLS) while explicitly requesting StartTls.

Common situations: Misconfigured port (993 implicit-SSL server probed with STARTTLS); old or hardened servers that only allow implicit TLS; corporate mail server with TLS-on-connect only.

Related errors

• The IMAP server does not support the STARTTLS extension.
• The LOGIN command is disabled.
• The POP3 server does not support the STLS extension.
• The POP3 server does not support the STLS extension.
• The SMTP server does not support the STARTTLS extension.

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/cfa6dfe294e3e097. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Imap/ImapClient.cs:1482

			connecting = true;

			var imap = new ImapStream (stream, ProtocolLogger);

			try {
				engine.Connect (imap, cancellationToken);
			} catch {
				connecting = false;
				throw;
			}

			try {
				// Only query the CAPABILITIES if the greeting didn't include them.
				if (engine.CapabilitiesVersion == 0)
					engine.QueryCapabilities (cancellationToken);

				if (options == SecureSocketOptions.StartTls && (engine.Capabilities & ImapCapabilities.StartTLS) == 0)
					throw new NotSupportedException ("The IMAP server does not support the STARTTLS extension.");

				if (starttls && (engine.Capabilities & ImapCapabilities.StartTLS) != 0) {
					var ic = engine.QueueCommand (cancellationToken, null, "STARTTLS\r\n");

					engine.Run (ic);

					if (ic.Response == ImapCommandResponse.Ok) {
						try {
							var tls = new ExtendedSslStream (stream, false, ValidateRemoteCertificate);
							imap.SetStream (tls);

							SslHandshake (tls, host, cancellationToken);
						} catch (Exception ex) {
							throw SslHandshakeException.Create (ref sslValidationInfo, ex, true, "IMAP", host, port, 993, 143);
						}

						engine.IsSecure = true;

View on GitHub (pinned to 9d3859a785)