Why Is Mimecast Blocking My Emails?

Mimecast is a secure email gateway that sits in front of a company's mailboxes, so when it blocks you, it's acting on behalf of one specific organization, not the whole internet. The most common reasons are greylisting (a temporary delay that clears on retry), a poor reputation for your sending IP, a spam score over the threshold, failed SPF, DKIM or DMARC checks, or a block someone at the recipient's company set up. The bounce message tells you which one, and for most of them the recipient's IT team can fix it faster than you can.

Unlike Gmail or Outlook.com, Mimecast's filtering is configured by each customer, so two companies on Mimecast can treat the same message differently.

How to tell it's Mimecast

Look at the bounce or your outbound logs. The receiving server will usually have a mimecast.com hostname, and the recipient domain's MX records will point to Mimecast. You can check the MX with any DNS lookup (dig MX example.com). If the bounce came from your own server or ESP, the original SMTP response from Mimecast is in there; find it.

Read the bounce: what each Mimecast error means

These come from Mimecast's own SMTP error code documentation. The text after the code is what you'll see in the bounce.

Common causes, most likely first

Greylisting

Mimecast greylists new senders by default: the first attempt gets a temporary 451, and your server is expected to retry between one minute and 12 hours later. Any properly configured mail server or ESP does this automatically. If your server doesn't retry within 12 hours, Mimecast rejects the message as a sender that failed to retry.

If you're seeing 451s from Mimecast that eventually deliver, that's normal. If they never deliver, check whether your sending system actually retries deferred mail. Some homegrown apps and form plugins don't.

Poor IP reputation

Mimecast checks public blocklists (the bounce will name the list) and keeps its own reputation data, which shows up as Local CT IP Reputation. Mimecast's docs say a moderately poor reputation gets a temporary deferral, and if it gets worse, the message is rejected.

For a public blocklist hit, fix the cause and request delisting from that list; see the blocklist playbook. For Mimecast's own reputation, Mimecast doesn't publish a self-service lookup for non-customers. The reliable path is the recipient: their administrator can permit you and can raise it with Mimecast support. If you're on shared IPs at an ESP, open a ticket with the ESP too, since the problem may be another customer's traffic.

Spam scoring (MCSpamSignature)

The 554 ... MCSpamSignature rejection means the message matched a virus signature or scored over the spam threshold. Mimecast doesn't show the score. Look at what changed: a new link domain, a URL shortener, an attachment type, a large image with little text, or a burst of volume to that one company. Content problems at a gateway like this usually ride on top of a reputation problem, so check why your emails might be going to spam for the broader picture.

SPF, DKIM or DMARC failures

Mimecast customers can turn on rejection for SPF hard fails and DMARC failures. If you see SPF Sender Invalid, DKIM Sender Invalid or DMARC Sender Invalid, it's your authentication, and it will be causing problems elsewhere too. Run the SPF, DKIM and DMARC checker, and see DMARC fail and the SPF lookup limit.

Someone at the recipient blocked you

Envelope blocked - User Entry means one person blocked your address, often by clicking "Block" in their Mimecast digest. That's not a reputation problem and nobody at Mimecast can undo it; the recipient has to remove you from their blocked senders. A policy-level block is the same idea set by an administrator.

Anti-spoofing

Mimecast's anti-spoofing policies reject inbound mail that claims to come from the customer's own domain. This catches legitimate vendors constantly: a payroll provider, a ticketing system or a marketing agency sending as hr@client-example.com from outside the client's network. The fix is on the recipient's side, an anti-spoofing exception for your IP or address, or better, have the vendor send from its own domain.

How to fix a Mimecast block, step by step

1. Get the exact bounce text. Pull the SMTP response from your ESP or MTA logs. Match it against the table above.
2. Fix what's yours. Authentication failures, blocklist listings, unretried deferrals, too many recipients, invalid addresses and content changes are all on your side.
3. Contact the recipient for what's theirs. Send the bounce text, your sending IP and your From address to your contact at the company, and ask them to forward it to IT. Their administrator can add you to Permitted Senders, which Mimecast says bypasses spam scanning, greylisting and IP reputation checks, or adjust the policy that blocked you.
4. Use Auto Allow where it fits. Mimecast's Auto Allow adds a sender automatically when an internal user emails them. If you have an existing relationship, asking your contact to send you an email first can be enough for future messages to get through.
5. Retest. Send a single message to that recipient and check your logs for a 250 accepted response.

How to confirm it's fixed

Your logs should show the recipient's Mimecast server accepting the message (a 250 response), and the recipient should confirm it arrived in their inbox, not in a held queue or their personal digest. For reputation issues, watch a few days of sends to other Mimecast-protected domains, since a permit by one customer doesn't help with the next.

How to keep it from coming back

• Keep SPF, DKIM and DMARC passing and aligned for every service that sends as you.
• Make sure every sending system retries 4xx deferrals.
• Don't send as your clients' domains from your infrastructure.
• Watch the blocklists that matter and remove bad addresses quickly.
• For key B2B recipients, ask to be permitted proactively during onboarding.

When to get help

If you're being blocked by Mimecast at many different companies at once, that points to a reputation problem on your side rather than one customer's settings, and it's worth getting an expert to look at it.

FAQ

Can I contact Mimecast to get unblocked?

Mimecast's support process is built for its customers, so the effective route is through the recipient's IT team. They can permit you directly and raise a case with Mimecast if your IP's reputation looks wrong.

Why does only one company's Mimecast block me?

Each Mimecast customer sets its own policies. One company may have strict DMARC enforcement, a geographic restriction or a user who blocked you, while another accepts the same message without trouble.

What does the Mimecast 451 greylisting error mean?

It's a temporary deferral for a sender Mimecast hasn't seen before. Your server should retry automatically between one minute and 12 hours later, and the message is usually accepted on retry.

Is Mimecast a blocklist?

Not in the public DNSBL sense. It's a filtering gateway that checks public blocklists and its own reputation data, then applies each customer's policies. There's no public Mimecast list to look yourself up on.