jstedfast/MailKit · error · ServiceNotAuthenticatedException

The Pop3Client has not been authenticated.

Error message

The Pop3Client has not been authenticated.

What it means

MailKit throws ServiceNotAuthenticatedException from Pop3Client.CheckAuthenticated() whenever a POP3 command that requires a logged-in session is issued while IsAuthenticated is false. The client may be connected, but the AUTH/USER-PASS handshake has not completed (or the session was dropped and reconnected without re-authenticating). It is a state precondition guard protecting commands like GetMessageCount, Size, NoOp, Count, and SupportsUids that the POP3 server only serves after authentication.

Solutions

1. Call client.Authenticate(username, password, cancellationToken) after Connect and before any message commands.
2. Check client.IsAuthenticated before issuing mailbox commands, and authenticate if false.
3. If using auto-connect/reconnect logic, re-run both Connect and Authenticate after every reconnection.
4. Verify the server actually advertises a SASL mechanism you support (check client.AuthenticationMechanisms); supply a matching SaslMechanism or fall back to user/password.

Example fix

// before
client.Connect("pop.example.com", 995, SecureSocketOptions.SslOnConnect);
int count = client.Count; // throws ServiceNotAuthenticatedException
// after
client.Connect("pop.example.com", 995, SecureSocketOptions.SslOnConnect);
client.Authenticate("user", "pass", cancellationToken);
int count = client.Count;

if (!client.IsConnected)
    client.Connect(host, port, SecureSocketOptions.SslOnConnect);
if (!client.IsAuthenticated)
    client.Authenticate(user, pass, cancellationToken);

try {
    int count = client.Count;
} catch (ServiceNotAuthenticatedException) {
    client.Authenticate(user, pass, cancellationToken);
    int count = client.Count;
}

When it happens

Trigger: Calling any of Count, GetMessageCount, Size, NoOp, SupportsUids, or QueueUidlCommand on a Pop3Client that is connected but on which Authenticate() was never called; or after a reconnect where authentication was not redone.

Common situations: Forgetting to call Authenticate after Connect before enumerating messages; credentials supplied only to Connect (POP3 needs explicit Authenticate); an SSL/TLS or network hiccup caused MailKit to reconnect, resetting the authenticated state; sharing a Pop3Client across threads where another thread disconnected; using SASL mechanisms not advertised by the server so authentication silently failed.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• The Pop3Client is already authenticated.
• No credentials could be found for the POP3 server.
• The Pop3Client must be connected before you can…
• No credentials could be found for the POP3 server.
• message

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/e755421e1807844f. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Pop3/Pop3Client.cs:256

			}
		}

		void CheckDisposed ()
		{
			if (disposed)
				throw new ObjectDisposedException (nameof (Pop3Client));
		}

		void CheckConnected ()
		{
			if (!IsConnected)
				throw new ServiceNotConnectedException ("The Pop3Client is not connected.");
		}

		void CheckAuthenticated ()
		{
			if (!IsAuthenticated)
				throw new ServiceNotAuthenticatedException ("The Pop3Client has not been authenticated.");
		}

		bool ValidateRemoteCertificate (object? sender, X509Certificate? certificate, X509Chain? chain, SslPolicyErrors sslPolicyErrors)
		{
			var host = engine.Uri!.Host;
			bool valid;

			sslValidationInfo?.Dispose ();
			sslValidationInfo = null;

			if (ServerCertificateValidationCallback != null) {
				valid = ServerCertificateValidationCallback (host, certificate, chain, sslPolicyErrors);
#if NETFRAMEWORK
			} else if (ServicePointManager.ServerCertificateValidationCallback != null) {
				valid = ServicePointManager.ServerCertificateValidationCallback (host, certificate, chain, sslPolicyErrors);
#endif
			} else {
				valid = DefaultServerCertificateValidationCallback (host, certificate, chain, sslPolicyErrors);

View on GitHub (pinned to 9d3859a785)