diff --git a/internal/server/auth/auth.go b/internal/server/auth/auth.go
index 2c82d09..70a7f31 100644
--- a/internal/server/auth/auth.go
+++ b/internal/server/auth/auth.go
@@ -67,7 +67,12 @@ func buildCapabilities(deps ServerDeps, isTLS bool) []string {
 	return capabilities
 }
 
-func HandleCapability(deps ServerDeps, conn net.Conn, tag string, state *models.ClientState) {
+func HandleCapability(deps ServerDeps, conn net.Conn, tag string, parts []string, state *models.ClientState) {
+	// RFC 3501: CAPABILITY takes no arguments.
+	if len(parts) > 2 {
+		deps.SendResponse(conn, fmt.Sprintf("%s BAD CAPABILITY takes no arguments", tag))
+		return
+	}
 	// Detect TLS: real TLS connection or test mock that advertises TLS
 	isTLS := false
 	if _, ok := conn.(*tls.Conn); ok {
diff --git a/internal/server/connection.go b/internal/server/connection.go
index 53fd9b9..0d505ba 100644
--- a/internal/server/connection.go
+++ b/internal/server/connection.go
@@ -52,7 +52,7 @@ func handleClient(s *IMAPServer, conn net.Conn, state *models.ClientState) {
 
 		switch cmd {
 		case "CAPABILITY":
-			auth.HandleCapability(s, conn, tag, state)
+			auth.HandleCapability(s, conn, tag, parts, state)
 		case "LOGIN":
 			auth.HandleLogin(s, conn, tag, parts, state)
 		case "AUTHENTICATE":
diff --git a/internal/server/testing_interface.go b/internal/server/testing_interface.go
index 677c1d2..20e1e97 100644
--- a/internal/server/testing_interface.go
+++ b/internal/server/testing_interface.go
@@ -26,7 +26,7 @@ func NewTestInterface(server *IMAPServer) *TestInterface {
 
 // HandleCapability exposes the capability handler for testing
 func (t *TestInterface) HandleCapability(conn net.Conn, tag string, state *models.ClientState) {
-	auth.HandleCapability(t.server, conn, tag, state)
+	auth.HandleCapability(t.server, conn, tag, []string{tag, "CAPABILITY"}, state)
 }
 
 // HandleLogin exposes the login handler for testing