Why Is Proofpoint Blocking My Emails? (And How to Request Delisting)

Proofpoint blocks your email for one of two reasons. Either Proofpoint's own reputation system, Proofpoint Dynamic Reputation (PDR), has linked your sending IP to spam, or the specific company you're emailing has a policy in its Proofpoint setup that rejects or quarantines your mail. The bounce text tells you which. A PDR block is fixed by cleaning up the source of the spam and submitting your IP through Proofpoint's IP lookup. A customer policy block has to be fixed by the recipient's IT team.

Proofpoint is one of the most widely used email security gateways for businesses, which is why a single block can cut you off from a long list of corporate recipients at once.

What a Proofpoint block looks like

Proofpoint documents two bounce formats from its reputation system. A block:

554 Blocked - see https://proofpoint.com/postmaster/?ip=203.0.113.7

And a deferral (a temporary delay, not a rejection):

421 Deferred - see https://proofpoint.com/postmaster/?ip=203.0.113.7

Its PDR FAQ also gives this sample rejection from a server running Proofpoint Email Security:

550 5.7.1 Email rejected because 203.0.113.7 is listed by Proofpoint.com

If the bounce mentions Proofpoint and an IP, it's almost certainly reputation. If it's a generic rejection from a company's mail server with no mention of Proofpoint's lookup, or your mail is arriving but sitting in the recipient's quarantine, it's more likely a policy set by that customer.

Proofpoint Dynamic Reputation: what it is

PDR scores IP addresses, not individual messages. Proofpoint says it uses hundreds of features and machine learning content classification to identify IPs that appear to be sending spam, for example machines that are part of a botnet. Those IPs get delayed or blocked across Proofpoint's customers.

A few details from Proofpoint's FAQ are worth knowing:

• Delays clear on their own, usually within a few minutes. You don't need to do anything about a one-off 421.
• Blocks persist while the spam continues. An IP that keeps sending spam stays blocked and is removed once it stops for a period of time. Proofpoint doesn't say how long.
• It's about spam from the IP. Proofpoint says it doesn't delay or block based on a particular domain or on bulk email as such. (Its postmaster page does describe the 554 as an IP "and/or domain" block, so don't rule your domain out entirely.)
• Shared IPs flip back and forth. Public access points and other shared IPs can bounce between blocked and not blocked as spam from other users comes and goes.

The common causes, most likely first

1. An infected machine or compromised account on your network. If your office mail goes out through an IP that also carries a botnet's traffic, the IP gets blocked. This is what PDR is built to catch.
2. A compromised website or web form sending spam through your mail server.
3. A shared IP at a hosting company or ESP that another customer is abusing.
4. Your own sending practices: purchased lists, poor opt-in, high complaint rates. Proofpoint's postmaster page cites a complaint rate under 0.3% as the industry standard.
5. Basic server misconfiguration. Proofpoint expects forward and reverse DNS that match, a HELO/EHLO with a fully qualified hostname (not "localhost" or a bare IP), plus SPF, DKIM and DMARC. Missing these doesn't create a PDR listing on its own, but Proofpoint says it may not be able to help senders who don't meet its guidelines.
6. A recipient's own policy. The customer may have blocked your domain or address, quarantined you as bulk mail, or set strict rules for unauthenticated mail. Proofpoint Essentials admins can allow senders and release quarantined messages themselves.

How to fix it, step by step

1. Get the IP from the bounce. It's the four dot-separated numbers in the rejection. If you send through an ESP or Microsoft 365, it's their IP, not yours.
2. Look it up at Proofpoint's IP lookup. It shows whether the IP is blocked or delayed and is also how you submit information to Proofpoint.
3. Find and fix the source of the spam before you ask for anything. Scan machines for malware, check for compromised mailboxes and forwarding rules, look at web forms and scripts, and check your outbound logs for mail you didn't intend to send.
4. Fix the basics: matching forward and reverse DNS, a proper HELO name, and SPF, DKIM and DMARC that pass. The email authentication checker confirms the DNS side.
5. Request delisting. Submit through the IP lookup or Proofpoint's contact form and include what the FAQ asks for: the recipient you were trying to reach, the type of mail (personal correspondence, newsletters or company communications), what your company does, and what you fixed (for example, "removed an infected workstation"). Proofpoint says it aims to review reports within one business day. Proofpoint customers have a separate support portal for faster handling.
6. If you're on a shared IP, open a ticket with your hosting provider or ESP. They own the IP and the delisting.
7. For a recipient policy block, ask your contact to have their IT team check their Proofpoint logs and add you as an allowed sender if appropriate.

Cloudmark, a Proofpoint company

Proofpoint acquired Cloudmark in 2017. Cloudmark Sender Intelligence (CSI) is a separate IP reputation service with its own remediation portal at csi.cloudmark.com/en/reset. If your bounce names Cloudmark rather than Proofpoint, use that portal instead of the Proofpoint lookup.

How to confirm it's fixed

Check the IP lookup again after Proofpoint responds, then send a test to the recipient who bounced. Watch your logs for new 554 or 421 responses from Proofpoint-protected domains over the next few days. If you see intermittent blocks, assume something on the IP is still sending spam.

How to keep it from coming back

• Keep endpoints patched and protected, and filter outbound mail if you run your own server.
• Enforce multi-factor authentication so phished accounts can't be used to send.
• Separate marketing and transactional mail onto different IPs if you control them, and ramp new IPs gradually. Proofpoint suggests no more than doubling volume from one period to the next.
• Honor unsubscribes quickly and keep complaints low.

For other blocklists that often show up alongside a Proofpoint block, see the blocklist playbook and Which email blocklists actually matter?. Mimecast works differently; see Why is Mimecast blocking my emails?

When to get help

If Proofpoint keeps re-blocking you after delisting, or you can't find what's sending spam from your IP, it's time for someone to go through your logs with you. Get in touch.

FAQ

How long does Proofpoint delisting take?

Proofpoint says it strives to review reports within one business day. Delays (421 responses) usually clear by themselves within minutes.

Is Proofpoint a blacklist?

Not a public one. PDR is Proofpoint's own reputation system used by its customers, not a DNS blocklist you can query from any checker. Use Proofpoint's own IP lookup to see your status.

Can Proofpoint block my domain, not just my IP?

Proofpoint's FAQ says PDR blocks are based on spam from the IP, not on a particular domain. Individual Proofpoint customers can still block your domain or address in their own policy settings.

Why is only one company blocking me?

If other Proofpoint-protected recipients get your mail fine, it's probably that company's own policy rather than PDR. Ask your contact to check with their IT team.