521 5.7.1 Proofpoint: connection refused at greeting

What it means

RFC 7504 defines reply 521 as “host does not accept mail”. A server may send it in place of the normal 220 greeting; after that it either answers every command except QUIT with 521 again or simply closes the connection, so your server never gets to deliver anything. Proofpoint does not publish this reply in its public documentation, but senders report it from Proofpoint gateways. When one does this, the text typically reads like a short policy or block notice naming your IP, and your MTA records it as a connection-level failure rather than a rejection of any recipient.

A 521 is a statement about the session, not the message. It usually means the gateway decided from your IP alone that it will not deal with you: a poor reputation score, a block that the recipient organization placed on your network range, or a country or ASN rule. Strictly, RFC 7504 reserves 521 for hosts that never accept mail and says it should not be used to refuse particular hosts (554 is the standard reply for that), so a gateway that sends 521 as a block is stretching the standard. Like any 5xx reply, it is permanent.

Compare it with the 554 ipcheck block, which often names the same reputation problem but arrives as an ordinary reply, and with 554 5.7.1 after DATA, which is about the content of one message.

Likely causes

• The connecting IP has a bad reputation score in Proofpoint’s data.
• The recipient organization blocked your IP, subnet, or whole network in its own Proofpoint settings.
• A geographic or ASN rule at the recipient that refuses connections from certain regions or hosting providers.
• Your server tried to deliver over IPv6 from an address with no reverse DNS, which some gateways refuse outright.

Checks that apply

• SMTP Diagnostics Connects to the Proofpoint MX from ProbeKit, which shows whether the gateway refuses everyone or only your server.
• MX Lookup Lists the recipient’s MX hosts; names under pphosted.com or ppe-hosted.com confirm you are dealing with Proofpoint.
• Reverse DNS (PTR) Checks reverse DNS for the IPv4 or IPv6 address your server used, a frequent reason for refusals at connect time.
• ASN Lookup Shows which network your IP belongs to, useful if the recipient blocks whole hosting providers.

FAQ

Will my server retry after a 521?

It should not. Every 5xx reply is permanent under RFC 5321, and RFC 7504 calls 521 a fatal reply, so a correct MTA returns the message instead of retrying that host.

Is a 521 worse than a 554?

Not in itself. A 521 just refuses earlier, at the greeting. The cause is often the same IP reputation problem a 554 ipcheck block reports.