jstedfast/MailKit · error · NotSupportedException

The POP3 server does not support the STLS extension.

Error message

The POP3 server does not support the STLS extension.

What it means

MailKit's Pop3Client.Connect throws this NotSupportedException when an explicit SecureSocketOptions.StartTls was requested, but the POP3 server did not advertise the STLS capability in its CAPA response. The library refuses to proceed because it cannot upgrade the connection to TLS as demanded. It is a capability-negotiation failure, not a network or certificate problem.

Solutions

1. Use SecureSocketOptions.SslOnConnect and connect to port 995 if the server supports implicit TLS.
2. Fall back to SecureSocketOptions.None (or Auto) if plaintext is acceptable, or upgrade the POP3 server to support STLS.
3. Verify the server's capabilities with 'CAPA' (telnet/openssl s_client) to confirm STLS is advertised.
4. Point the client at a different host/port where TLS is actually offered.

Example fix

// before
client.Connect ("pop.example.com", 110, SecureSocketOptions.StartTls);
// after
client.Connect ("pop.example.com", 995, SecureSocketOptions.SslOnConnect);

// After connecting with Auto/None or before choosing options, inspect capabilities
client.Connect (host, port, SecureSocketOptions.Auto, cancellationToken);
bool stlsAvailable = client.Capabilities.HasFlag (Pop3Capabilities.StartTLS);
if (!stlsAvailable) throw new InvalidOperationException ("Server lacks STLS; use port 995 / SslOnConnect.");

try {
    client.Connect (host, 110, SecureSocketOptions.StartTls, cancellationToken);
} catch (NotSupportedException) {
    client.Connect (host, 995, SecureSocketOptions.SslOnConnect, cancellationToken);
}

When it happens

Trigger: Calling Pop3Client.Connect with options: SecureSocketOptions.StartTls against a POP3 server whose CAPA output lacks the STLS capability (e.g. a plaintext POP3 server on port 110 with no TLS support, or one that only supports implicit TLS on port 995).

Common situations: Configuring a mail client for STARTTLS against an old or misconfigured POP3 server; connecting to port 995 (implicit TLS) with StartTls instead of SslOnConnect; corporate/ISP servers that dropped STLS support; server behind a proxy that strips capabilities.

Related errors

• The POP3 server does not support the STLS extension.
• The IMAP server does not support the STARTTLS extension.
• The SMTP server does not support the STARTTLS extension.
• The IMAP server does not support the STARTTLS extension.
• The LOGIN command is disabled.

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/881ea031562a7043. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Pop3/Pop3Client.cs:1132

		{
			probed = ProbedCapabilities.None;

			try {
				ProtocolLogger.LogConnect (engine.Uri!);
			} catch {
				stream.Dispose ();
				throw;
			}

			var pop3 = new Pop3Stream (stream, ProtocolLogger);

			engine.Connect (pop3, cancellationToken);

			try {
				engine.QueryCapabilities (cancellationToken);

				if (options == SecureSocketOptions.StartTls && (engine.Capabilities & Pop3Capabilities.StartTLS) == 0)
					throw new NotSupportedException ("The POP3 server does not support the STLS extension.");

				if (starttls && (engine.Capabilities & Pop3Capabilities.StartTLS) != 0) {
					SendCommand (cancellationToken, "STLS\r\n");

					try {
						var tls = new ExtendedSslStream (stream, false, ValidateRemoteCertificate);
						pop3.SetStream (tls);

						SslHandshake (tls, host, cancellationToken);
					} catch (Exception ex) {
						throw SslHandshakeException.Create (ref sslValidationInfo, ex, true, "POP3", host, port, 995, 110);
					}

					engine.IsSecure = true;

					// re-issue a CAPA command
					engine.QueryCapabilities (cancellationToken);
				}

View on GitHub (pinned to 9d3859a785)