iCloud Mail blocked IP: Proofpoint ipcheck reference
Blocked - see ipcheck.proofpoint.comiCloud Mail block based on Proofpoint IP reputationFrom iCloud Mail
554 5.7.1 Blocked - see https://ipcheck.proofpoint.com/?ip=203.0.113.5 (in reply to RCPT TO <user@icloud.com>)
What it means
Apple’s inbound mail filtering has long drawn on Proofpoint’s IP reputation data. When the address that connected to iCloud scores badly there, the rejection usually reads like a short “Blocked” line with a link to Proofpoint’s ipcheck page and your IP in the query string. The exact reply and enhanced codes vary between a 550 and a 554 form, but the link is the giveaway.
This is a block on the connecting IP, not on your domain or the message. It often happens before your server even sends the body, so changing the subject or links does nothing. Every message from that IP to icloud.com, me.com, and mac.com recipients is likely affected until the reputation recovers.
It differs from [CS01], where Apple judged the message itself, and from a generic Proofpoint ipcheck block at a company that runs Proofpoint on its own gateway: the lookup is the same, but the people you would talk to are different.
Likely causes
- Spam or a phishing run sent from a compromised account or web app on the same server.
- A shared IP at a hosting company or ESP where another customer damaged the reputation.
- A newly assigned IP that inherited a bad history from its previous user.
- High volumes to addresses that do not exist, which Proofpoint treats as list harvesting or a stale list.
How to fix it
- Open the ipcheck link from the bounce, or look the IP up at ipcheck.proofpoint.com, and read what it reports for that address.
- Find and stop the source of bad mail first: check queue sizes, outbound logs, and accounts with unusual volume.
- Use the removal request form on the ipcheck page once the cause is fixed, describing what you changed.
- If the IP is shared at a provider, open a ticket with them instead; they control the IP and its delisting.
- While you wait, move urgent mail to Apple users through a relay with a clean IP, and keep its SPF record updated to include it.
Checks that apply
- Blacklist Check Shows whether the same IP is also on public DNSBLs, which usually means a wider problem than Apple alone.
- ASN Lookup Identifies the network that owns the IP, so you know whether the provider or you must request the delisting.
- Reverse DNS (PTR) Confirms the IP has proper reverse DNS, since generic PTR names on hosting ranges make reputation recover more slowly.
FAQ
- Do I contact Apple or Proofpoint?
- Start with Proofpoint’s ipcheck page, because the block cites its data. Contact Apple only if the IP shows as clean there and iCloud still refuses you.
- How long until iCloud accepts mail again?
- Neither company promises a time. Once a removal request is accepted, many senders report delivery recovering within a day or two, but listings return if the bad traffic continues.