jstedfast/MailKit · error · NotSupportedException

The SMTP server does not support authentication.

Error message

The SMTP server does not support authentication.

What it means

SmtpClient.Authenticate throws NotSupportedException when the server's EHLO capabilities do not include SMTP AUTH (the SmtpCapabilities.Authentication bit is unset). The server advertised no authentication extension, so no AUTH command can succeed.

Solutions

1. Connect to the submission port 587 (or 465) with STARTTLS/SSL so the server advertises AUTH.
2. Verify capabilities with client.Capabilities after connecting; only call Authenticate when (capabilities & SmtpCapabilities.Authentication) != 0.
3. Confirm the hostname points to an SMTP submission server, not a plain MX relay.

Example fix

// before
client.Connect("mail.example.com", 25, SecureSocketOptions.None);
client.Authenticate(user, pass); // NotSupportedException

// after
client.Connect("smtp.example.com", 587, SecureSocketOptions.StartTls);
if ((client.Capabilities & SmtpCapabilities.Authentication) != 0)
    client.Authenticate(user, pass);

if ((client.Capabilities & SmtpCapabilities.Authentication) == 0)
    throw new InvalidOperationException("SMTP server does not advertise AUTH; check host/port/TLS.");

try {
    client.Authenticate(user, pass);
} catch (NotSupportedException ex) {
    // log server capabilities: client.AuthenticationMechanisms
    throw new MailConfigurationException("Server lacks AUTH support", ex);
}

When it happens

Trigger: Calling Authenticate on a server whose EHLO response lacks AUTH/ AUTH= mechanisms — e.g. an MX server that is receive-only, port 25 relays, or a misconfigured server that hides AUTH before STARTTLS.

Common situations: Connecting to port 25 where AUTH is often disabled; servers that only offer AUTH after switching to TLS (client used SecureSocketOptions.None or SslOnConnect incorrectly, or STARTTLS wasn't negotiated); targeting the wrong host (internal relay vs submission server).

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• The SMTP server does not support the STARTTLS extension.
• Value cannot be null. (Parameter 'message')
• Value cannot be null. (Parameter 'response')
• The IMAP server does not support the STARTTLS extension.
• The POP3 server does not support the STLS extension.

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/fe8a0abb14ef2f6a. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Smtp/SmtpClient.cs:1005

				UpdateCapabilities (response);
			}
		}

		void ValidateArguments (SaslMechanism mechanism)
		{
			if (mechanism == null)
				throw new ArgumentNullException (nameof (mechanism));

			CheckDisposed ();

			if (!IsConnected)
				throw new ServiceNotConnectedException ("The SmtpClient must be connected before you can authenticate.");

			if (IsAuthenticated)
				throw new InvalidOperationException ("The SmtpClient is already authenticated.");

			if ((capabilities & SmtpCapabilities.Authentication) == 0)
				throw new NotSupportedException ("The SMTP server does not support authentication.");

			mechanism.ChannelBindingContext = Stream.Stream as IChannelBindingContext;
			mechanism.Uri = new Uri ($"smtp://{uri.Host}");
		}

		/// <summary>
		/// Authenticate using the specified SASL mechanism.
		/// </summary>
		/// <remarks>
		/// <para>Authenticates using the specified SASL mechanism.</para>
		/// <para>For a list of available SASL authentication mechanisms supported by the server,
		/// check the <see cref="AuthenticationMechanisms"/> property after the service has been
		/// connected.</para>
		/// </remarks>
		/// <param name="mechanism">The SASL mechanism.</param>
		/// <param name="cancellationToken">The cancellation token.</param>
		/// <exception cref="System.ArgumentNullException">
		/// <paramref name="mechanism"/> is <see langword="null" />.

View on GitHub (pinned to 9d3859a785)