ProbeKit
Sign inSign up

Mimecast 451 Open relay not allowed: route not set up

451 Open relay not allowedMimecast open relay refusalTemporary: the sender retriesFrom Mimecast

Example
451 An open relay is not allowed.

What it means

An open relay is a mail server that passes mail between any two outside parties. Mimecast refuses to act as one. Its published SMTP error reference lists this as a 451: the sender and recipient domains are both external to Mimecast, and/or the connecting IP address is not recognized as authorized. The reply text is the example, sometimes shortened to “Open relay not allowed” in logs.

There are two common setups. Inbound: a domain’s MX points to Mimecast, but the domain was never added to (or was removed from) the customer’s Mimecast account, so Mimecast has no reason to accept mail for it. Outbound: the customer’s own mail server sends through Mimecast from an IP or with credentials Mimecast does not associate with that customer.

Because it is a 451, the sending server keeps the message and retries, but every retry meets the same answer until the route is fixed, and the message eventually expires. Mimecast is not saying anything about the content or your reputation. It is saying the route is not configured, which is something only the Mimecast customer can correct.

Likely causes

  • A new or alias domain whose MX was pointed at Mimecast before the domain was added to the account.
  • A domain that left Mimecast but still has Mimecast MX records in DNS.
  • An outbound mail server relaying through Mimecast from a new IP that is not registered as an authorized outbound gateway.
  • A typo in the recipient domain that happens to point at a Mimecast customer’s infrastructure.

How to fix it

  1. Look up the recipient domain’s MX records to confirm it really points at Mimecast.
  2. If the domain should be on Mimecast, its admin adds and verifies it as an internal domain in the Mimecast console.
  3. If the domain left Mimecast, its owner updates the MX records to the new provider and waits for the old TTL to expire.
  4. For outbound relay, the admin adds the new server IP to the account’s Authorized Outbound addresses (Mimecast’s reference says to contact Mimecast Support for this) or switches the server to authenticated SMTP.

Checks that apply

  • MX Lookup Shows whether the domain’s MX still points at Mimecast, the first thing to rule in or out.
  • DNS Propagation Checks MX answers across public resolvers, useful right after a domain moved to or from Mimecast.
  • SMTP Diagnostics Connects to the MX and shows which Mimecast region and host is answering for the domain.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Does this mean my server is an open relay?
No. It means Mimecast refused to relay for you, because the route is not configured on its side. Your own server’s relay settings are not being judged.
Who has to fix it?
The Mimecast customer that owns the domain or the outbound server. A third-party sender can only report it.

Sources:Policies: Mimecast SMTP Error Codes (Mimecast Support)Checked 2026-10-18

All 191 bounce codes