Mimecast: Email rejected due to security policies
550 Email rejected due to security policiesMimecast security policy rejectionPermanent: retrying will not helpFrom Mimecast
550 Email rejected due to security policies
What it means
This is one of Mimecast’s broad refusal messages. It tells you Mimecast’s own protection layer, not a rule written by the individual customer, decided the message was a risk. In most cases it relates to the reputation of the IP that connected, as judged by Mimecast’s threat data, though it can also follow malware or impersonation detection.
Because it comes from Mimecast’s shared protections, the same sender is often refused at several Mimecast customers at once. That pattern helps you separate it from “Envelope blocked”, which is local to one organization.
The text does not name the exact reason, and Mimecast does not offer senders a public lookup like Proofpoint’s ipcheck. The practical path is to clean up anything that hurts IP and domain reputation, and to have a recipient raise it with Mimecast if the problem continues.
Likely causes
- The sending IP appears on public blocklists or in Mimecast’s own threat intelligence.
- Recent malware or phishing was sent from your domain or IP, perhaps from a compromised account.
- Your mail fails SPF, DKIM, and DMARC, which makes impersonation checks more likely to fire.
- A shared ESP or hosting IP used by other senders with a poor record.
How to fix it
- Check your outbound IP on public blocklists and remove any listing, after fixing the cause.
- Look for compromised accounts or scripts: unusual volume, unknown recipients, or messages you did not write in your sent logs.
- Get SPF, DKIM, and DMARC passing for the From domain, then resend one message to test.
- If the IP is shared, ask your provider to move you to a cleaner pool or a dedicated IP.
- If it still fails, ask the recipient’s IT team to open a case with Mimecast support quoting the bounce and your IP.
Checks that apply
- Blacklist Check Finds listings on 40 public DNSBLs, the most common visible sign of the reputation problems this bounce reflects.
- Domain Health Grades SPF, DKIM, DMARC, and DNS for your domain, covering the authentication side of Mimecast’s checks.
- ASN Lookup Identifies who owns the IP, so you know whether to clean it yourself or escalate to your provider.
FAQ
- Can I request removal from Mimecast directly?
- Mimecast does not publish a self-service delisting form for senders. Fix the cause and, if needed, ask a recipient who is a Mimecast customer to raise a support case.
- Will the message be retried?
- No. It is a 550, so your server returns it at once.