Mimecast "550 Rejected by header based Anti-Spoofing policy", "Envelope blocked" and Proofpoint "554 5.7.0 Blocked": fixes

What it means

Many companies protect their mailboxes with a security gateway: a filter that checks every email before it reaches the company's own server. Mimecast and Proofpoint are two of the most common. When they refuse your email, the bounce comes from the recipient's filter, configured by the recipient's IT team. The messages usually look like these:

550 Rejected by header based Anti-Spoofing policy: user@example.com

550 Envelope blocked - User Entry - https://...

554 5.7.0 Blocked - see https://ipcheck.proofpoint.com/?ip=203.0.113.10

Proofpoint may also return a 550 5.7.1 code with words like "Reject for policy reason". Barracuda, another common filter, has its own codes covered in a separate guide.

Why it happens

Mimecast "Anti-Spoofing policy"

This means the email claims to come from the recipient company's own domain (or a domain it protects), but arrived from outside. Mimecast treats that as possible spoofing. Typical legitimate cases: a website, CRM or invoicing tool that sends "as" the customer's domain, a scanner hosted elsewhere, or an outside agency sending newsletters for the company.

Mimecast "Envelope blocked - User Entry"

Someone at the recipient company, often the recipient themselves, has blocked your address or domain, for example from their spam digest. It is a personal or admin block, not a reputation problem.

Proofpoint "Blocked - see ipcheck.proofpoint.com"

Proofpoint has a poor reputation score for your sending IP address. This happens with IPs that sent spam, are on public blocklists, are new, or are shared with bad senders.

Other "policy" rejections

The company may refuse attachments of some types, emails failing DMARC, newly registered domains or certain countries. Only the IT team can tell you which rule matched.

How to check

1. Run a Delivmail test. From the same server or tool, send an email to the unique address on the home page (/). Check SPF, DKIM and DMARC, the sending IP, blacklists and content score. Filters weigh all of these.
2. Check blocklists. Enter the sending IP and your domain at /blacklists.
3. Use Proofpoint's tool. Open ipcheck.proofpoint.com and enter the IP from the bounce. It tells you if the IP is blocked and offers a request form for removal.
4. Keep the full bounce, with date, time and any reference ID. The IT team needs it to find your email in their logs.

How to fix it

1. Fix what is on your side first. Make sure SPF, DKIM and DMARC pass and align with your From domain, and clean any blocklist listing.
2. For Proofpoint IP blocks, submit the request form on ipcheck.proofpoint.com after fixing the cause. On a shared provider, send the bounce to your provider: they manage the IP.
3. For anti-spoofing, do not send as the recipient's domain from your own systems unless they set it up. Either send from your own domain, or ask the company to authorize your service (in their SPF and DKIM, and in their Mimecast policy).
4. For "User Entry" blocks, contact the recipient by another channel (phone, another address) and ask them to remove the block from their sender list.
5. Contact the IT team. Ask your contact to forward your request to their IT or security team. Be short and precise:
   • the full bounce text and the time it happened;
   • your sending IP and your domain;
   • a one-line explanation of why you email them (customer, supplier...);
   • a request to allow your domain or IP, or to tell you which rule matched.

Never try to get around a company filter by changing addresses or domains: it looks exactly like spam and makes things worse.

Check that it is fixed

Send a new Delivmail test and confirm authentication passes and blacklists are clean. Once the IT team confirms a change, or Proofpoint removes the block (often within a day or two), send a short email to the recipient and ask them to confirm it arrived. Company filters can also quarantine without bouncing, so a reply is the only real proof.