550: rejected by an anti-spoofing policy
The message claims to come from one of the recipient company’s own domains but arrived from outside, so Mimecast’s anti-spoofing policy rejected it.
- Mimecast
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550
- Provider
- Mimecast
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The recipient's side. Their mail admin has to change something; you can tell them.
- What the server says
550 Rejected by header-based Anti-Spoofing policy.
What it means
Mimecast’s anti-spoofing policies block external messages that appear to come from an internal domain, which is how many phishing attempts look. Mimecast lists two wordings for this rejection: Anti-Spoofing policy - Inbound not allowed, and a header-based form, which points to the From header. Legitimate mail hits this when a third party sends on the company’s behalf: a marketing platform, a ticketing system or a scanner using the company’s own address. Mimecast’s fix is a policy on the customer side that takes no action for that sender’s address or IP, so it is the recipient’s administrator who has to allow it.
Common causes
- An outside service sends as the recipient company’s own domain, for example a newsletter or support tool set up for them.
- A message was forwarded or relayed in a way that kept an internal From address while arriving from an external server.
- A real spoofing attempt, which is what the policy exists to stop.
How to fix it
- 01Check which From and envelope addresses your message used; if they are the recipient company’s own domain, the policy is doing its job.
- 02If you send for that company legitimately, give their administrator your sending IPs and addresses.
- 03Their administrator then creates an anti-spoofing policy that takes no action for those sources, as Mimecast describes.
- 04Where possible, send from your own domain instead of the customer’s, with your own SPF and DKIM.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Policies - Mimecast SMTP Error Codes (Mimecast support)mimecastsupport.zendesk.com
- Policies - Configuring Anti-Spoofing (Mimecast support)mimecastsupport.zendesk.com
Related codes
550 at other providers
- 550 [SC-001]Outlook.com policy block for content or reputation.Outlook.com rejected the mail for policy reasons tied to spam-like content or to the reputation of the sending IP or domain.
- 550 [SC-002]Outlook.com block for namespace mining.Outlook.com blocked the sending IP because it behaved like a namespace miner, checking whether addresses exist without sending mail.
- 550 [SC-003]Outlook.com block for an open proxy or relay.Outlook.com rejected the mail because the sending IP appears to be an open proxy or open relay.
- 550 [SC-004]Outlook.com block after complaints.Outlook.com placed a block on the sending IP because it received complaints about mail coming from it.
- 550 [DY-001]Outlook.com refuses dynamic IP addresses.Outlook.com rejected the mail because the sending IP is dynamic address space, which it generally does not accept mail from.
- 550 [DY-002]Outlook.com block for a likely compromised sender.Outlook.com rejected the mail because the sending server or computer appears to be compromised or infected.
Further reading
All 19 Mimecast codesEvery code in the wikiPaste your own bounce