diff --git a/dkim/sig.go b/dkim/sig.go
index 321152b..aed27ee 100644
--- a/dkim/sig.go
+++ b/dkim/sig.go
@@ -117,7 +117,7 @@ func (s *Sig) Header() (string, error) {
 			} else if i == len(s.SignedHeaders)-1 {
 				v += ";"
 			}
-			w.Addf(sep, v)
+			w.Addf(sep, "%s", v)
 		}
 	}
 	if len(s.CopiedHeaders) > 0 {
@@ -139,7 +139,7 @@ func (s *Sig) Header() (string, error) {
 			} else if i == len(s.CopiedHeaders)-1 {
 				v += ";"
 			}
-			w.Addf(sep, v)
+			w.Addf(sep, "%s", v)
 		}
 	}
 
diff --git a/imapserver/selectexamine_test.go b/imapserver/selectexamine_test.go
index e11bbdf..58645d6 100644
--- a/imapserver/selectexamine_test.go
+++ b/imapserver/selectexamine_test.go
@@ -45,28 +45,28 @@ func testSelectExamine(t *testing.T, examine bool) {
 	uuidnext2 := imapclient.UntaggedResult{Status: imapclient.OK, RespText: imapclient.RespText{Code: "UIDNEXT", CodeArg: imapclient.CodeUint{Code: "UIDNEXT", Num: 2}, More: "x"}}
 
 	// Parameter required.
-	tc.transactf("bad", cmd)
+	tc.transactf("bad", "%s", cmd)
 
 	// Mailbox does not exist.
-	tc.transactf("no", cmd+" bogus")
+	tc.transactf("no", "%s bogus", cmd)
 
-	tc.transactf("ok", cmd+" inbox")
+	tc.transactf("ok", "%s inbox", cmd)
 	tc.xuntagged(uflags, upermflags, urecent, uexists0, uuidval1, uuidnext1, ulist)
 	tc.xcode(okcode)
 
-	tc.transactf("ok", cmd+` "inbox"`)
+	tc.transactf("ok", `%s "inbox"`, cmd)
 	tc.xuntagged(uclosed, uflags, upermflags, urecent, uexists0, uuidval1, uuidnext1, ulist)
 	tc.xcode(okcode)
 
 	// Append a message. It will be reported as UNSEEN.
 	tc.client.Append("inbox", nil, nil, []byte(exampleMsg))
-	tc.transactf("ok", cmd+" inbox")
+	tc.transactf("ok", "%s inbox", cmd)
 	tc.xuntagged(uclosed, uflags, upermflags, urecent, uunseen, uexists1, uuidval1, uuidnext2, ulist)
 	tc.xcode(okcode)
 
 	// With imap4rev2, we no longer get untagged RECENT or untagged UNSEEN.
 	tc.client.Enable("imap4rev2")
-	tc.transactf("ok", cmd+" inbox")
+	tc.transactf("ok", "%s inbox", cmd)
 	tc.xuntagged(uclosed, uflags, upermflags, uexists1, uuidval1, uuidnext2, ulist)
 	tc.xcode(okcode)
 }
diff --git a/imapserver/server.go b/imapserver/server.go
index 59ad488..8ddebd7 100644
--- a/imapserver/server.go
+++ b/imapserver/server.go
@@ -1167,7 +1167,7 @@ func (c *conn) xsequence(uid store.UID) msgseq {
 func (c *conn) sequenceRemove(seq msgseq, uid store.UID) {
 	i := seq - 1
 	if c.uids[i] != uid {
-		xserverErrorf(fmt.Sprintf("got uid %d at msgseq %d, expected uid %d", uid, seq, c.uids[i]))
+		xserverErrorf("got uid %d at msgseq %d, expected uid %d", uid, seq, c.uids[i])
 	}
 	copy(c.uids[i:], c.uids[i+1:])
 	c.uids = c.uids[:len(c.uids)-1]
diff --git a/smtpserver/server.go b/smtpserver/server.go
index 424c88c..629f3ae 100644
--- a/smtpserver/server.go
+++ b/smtpserver/server.go
@@ -3471,7 +3471,7 @@ func (c *conn) deliver(ctx context.Context, recvHdrFor func(string) string, msgW
 			code = smtp.C554TransactionFailed
 		}
 		lines = append(lines, "multiple errors")
-		xsmtpErrorf(code, secode, !serverError, strings.Join(lines, "\n"))
+		xsmtpErrorf(code, secode, !serverError, "%s", strings.Join(lines, "\n"))
 	}
 	// Generate one DSN for all failed recipients.
 	if len(deliverErrors) > 0 {