554: blocked by Proofpoint for spam or malicious activity
Proofpoint has blocked your sending IP or domain because of spam it received or malicious activity it detected, and the reply links to its postmaster page.
- Proofpoint
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 554
- Provider
- Proofpoint
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
554 Blocked - see https://proofpoint.com/postmaster/?ip=1.2.3.4
What it means
Proofpoint’s postmaster site lists this as one of its SMTP replies: the IP, the domain or both have been blocked after Proofpoint received spam or detected malicious activity from them. It is a permanent rejection. Proofpoint evaluates sending IPs and domains on behaviour, content and authentication, and its guidance covers reverse DNS, a HELO name that matches it, SPF, DKIM, DMARC, TLS, gradual volume increases on new IPs and clean lists. The block is Proofpoint’s, so it can apply to mail bound for any of its customers. Proofpoint accepts delist requests from senders who meet its guidelines.
Common causes
- Spam from your IP or domain, intended or not, such as unsolicited mail or messages from a compromised account.
- A website or domain linked in your mail that is infected or used to spread harmful content.
- A new IP sending at volume without a history, or poor authentication and DNS setup.
How to fix it
- 01Open the link in the reply or look up your IP on Proofpoint’s IP check page to see its status.
- 02Remove the cause: secure compromised accounts, clean an infected site, stop mailing people who did not opt in.
- 03Check reverse DNS, HELO, SPF, DKIM and DMARC against Proofpoint’s postmaster guidance.
- 04Submit a delist request through the IP check page once the problem is fixed.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Proofpoint Postmasterproofpoint.com
Related codes
- 554Transaction failed.The server permanently refused the transaction, often after receiving the message data or straight away when the connection opened.
- 550 5.7.1Sending IP blocked by Proofpoint Dynamic Reputation.Proofpoint’s IP reputation system has your sending IP on its block list because it has seen spam or viruses from it, so Proofpoint customers refuse your mail.
- 421Throttled by Proofpoint for unusual sending.Proofpoint is slowing down mail from your IP because its sending pattern looks unusual or unexpected. Your server should retry, and the delay often clears on its own.
554 at other providers
- 554Permanent rejection (554).Yahoo or AOL rejected the message for good with a 554. Yahoo uses this code for several problems, from failed authentication to unacceptable content, so the wording of the reply tells you which.
- 554Failed authentication.Yahoo or AOL refused the message because it failed the checks that confirm the sending domain, such as DKIM against the domain's policy. Yahoo lists this among its permanent 553 and 554 errors.
- 554Recipient does not exist.The Yahoo or AOL account you wrote to does not exist. The failure is permanent: check the address with the recipient, and remove it from any list.
- 554No reverse DNS (PTR) record.Xfinity refused the connection because your sending IP has no PTR record. Every server sending to Xfinity needs valid reverse DNS, so the owner of the IP must add one.
- 554Rejected for breaking GMX guidelines.GMX refused the message permanently because the connection broke its guidelines. GMX points to its requirements page and asks for the full error message if the problem continues.
- 554IP address on the GMX blocklist.Your sending IP is on a blocklist that GMX manages itself, so its servers refuse the connection. GMX keeps a strict no tolerance policy toward spam.
Further reading
All 3 Proofpoint codesEvery code in the wikiPaste your own bounce