550: blocked by a sender policy or a failed SPF check
The recipient company’s Mimecast account refused your sender address or domain, either through a Blocked Senders policy or because the message hard-failed SPF.
- Mimecast
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550
- Provider
- Mimecast
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- Either side, depending on the cause. Start with the checks below that are yours.
- What the server says
550 Administrative prohibition envelope blocked.
What it means
This is a permanent rejection from the Mimecast gateway in front of the recipient’s mailboxes. Mimecast documents two triggers for it: the sender’s email address or domain matches a Blocked Senders policy the customer configured, or the message produced an SPF hard failure, meaning the sending IP is not authorised by the SPF record of the envelope sender’s domain. The two have different owners. An SPF failure is yours to fix in DNS, and it would affect other recipients that enforce SPF too. A Blocked Senders entry exists only in that one company’s account and only its administrators can remove it.
Common causes
- Your SPF record does not include the server or service that sent the message, and it ends in -all.
- An administrator at the recipient company added your address or domain to a Blocked Senders policy.
- A new sending tool was added without updating SPF for the envelope sender domain it uses.
How to fix it
- 01Look up the SPF record of your envelope sender domain and confirm it covers the IP that sent the message.
- 02Add any missing service to the record, keeping it within the 10 DNS lookup limit.
- 03If SPF passes, ask the recipient through another channel to have their IT team exclude your address from their Mimecast Blocked Senders policy.
- 04Resend once one of the two has changed; the rejected message was not kept.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Policies - Mimecast SMTP Error Codes (Mimecast support)mimecastsupport.zendesk.com
Related codes
- 550Mailbox unavailable.The receiving server permanently refused the message for this recipient: the mailbox does not exist, cannot be reached, or the server rejected the message by policy.
- 550SPF check failed.Mimecast rejected the message because the IP that sent it is not listed in the SPF record of the sender’s domain, and the recipient’s policy rejects SPF failures.
- 550Blocked by the company’s Blocked Senders policy.An administrator of the recipient’s Mimecast account set a Blocked Senders policy that matches your From or envelope sender address, so the message is refused.
550 at other providers
- 550 [SC-001]Outlook.com policy block for content or reputation.Outlook.com rejected the mail for policy reasons tied to spam-like content or to the reputation of the sending IP or domain.
- 550 [SC-002]Outlook.com block for namespace mining.Outlook.com blocked the sending IP because it behaved like a namespace miner, checking whether addresses exist without sending mail.
- 550 [SC-003]Outlook.com block for an open proxy or relay.Outlook.com rejected the mail because the sending IP appears to be an open proxy or open relay.
- 550 [SC-004]Outlook.com block after complaints.Outlook.com placed a block on the sending IP because it received complaints about mail coming from it.
- 550 [DY-001]Outlook.com refuses dynamic IP addresses.Outlook.com rejected the mail because the sending IP is dynamic address space, which it generally does not accept mail from.
- 550 [DY-002]Outlook.com block for a likely compromised sender.Outlook.com rejected the mail because the sending server or computer appears to be compromised or infected.
Further reading
All 19 Mimecast codesEvery code in the wikiPaste your own bounce