semaphoreui/semaphore · error

wrong host name

Error message

wrong host name

What it means

After the TLS check, PLAIN auth verifies that the smtp.ServerInfo.Name (the hostname the client connected to) matches the host the plainAuth was created with. A mismatch means the credentials could be sent to a different server than intended, so Start aborts with 'wrong host name'.

Solutions

1. Make the mailer SMTP host config exactly match the hostname used for the connection (same string, no alias vs FQDN mismatch).
2. Connect using the same host value that is passed to plainAuth instead of an IP address.
3. Update DNS/aliases or the configured host after infrastructure renames so both sides agree.

Example fix

// before
client, _ := smtp.Dial("10.0.0.5:587")            // ServerInfo.Name = "10.0.0.5"
a := mailer.PlainAuth("", user, pass, "smtp.example.com")
// after
client, _ := smtp.Dial("smtp.example.com:587")    // names now match
a := mailer.PlainAuth("", user, pass, "smtp.example.com")

if serverName != smtpConfig.Host {
    return fmt.Errorf("connection server name %q does not match configured SMTP host %q", serverName, smtpConfig.Host)
}

ok, enc, err := auth.Start(&serverInfo)
if err != nil && err.Error() == "wrong host name" {
    return fmt.Errorf("connect with the same hostname passed to PlainAuth (no IP/alias mismatch): %w", err)
}

When it happens

Trigger: The smtp.Client connection's server name differs from the host passed to plainAuth - e.g. connecting via IP address or alias while auth was built with the FQDN, or a hostname change in config without updating the auth setup.

Common situations: SMTP config uses 'mail.example.com' but connection established to an IP or 'smtp.example.com'; DNS aliases/CNAMEs; load balancer endpoints; host renamed during a migration.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• unencrypted connection
• unsupported TLS version
• You can't use both HTTP redirect address and port at the…
• http requests forbidden
• unexpected server challenge

AI-assisted analysis of semaphoreui/semaphore@1774ccb71a (2026-09-07). Data as JSON: /api/errors/f18cccc246068176. Report an issue: GitHub.

Appendix: source

Thrown at util/mailer/auth.go:36

type plainOrLoginAuth struct {
	username   string
	password   string
	host       string
	authMethod string
}

func (a *plainOrLoginAuth) Start(server *smtp.ServerInfo) (string, []byte, error) {
	// Must have TLS, or else localhost server.
	// Note: If TLS is not true, then we can't trust ANYTHING in ServerInfo.
	// In particular, it doesn't matter if the server advertises PLAIN auth.
	// That might just be the attacker saying
	// "it's ok, you can trust me with your password."
	if !server.TLS && !isLocalhost(server.Name) {
		return "", nil, errors.New("unencrypted connection")
	}
	if server.Name != a.host {
		return "", nil, errors.New("wrong host name")
	}
	if !slices.Contains(server.Auth, "PLAIN") {
		a.authMethod = "LOGIN"
		return a.authMethod, nil, nil
	} else {
		a.authMethod = "PLAIN"
		resp := []byte("\x00" + a.username + "\x00" + a.password)
		return a.authMethod, resp, nil
	}
}

func (a *plainOrLoginAuth) Next(fromServer []byte, more bool) ([]byte, error) {
	if !more {
		return nil, nil
	}

	if a.authMethod == "PLAIN" {
		// We've already sent everything.

View on GitHub (pinned to 1774ccb71a)