554 Blocked: Proofpoint ipcheck IP reputation block
554 Blocked - see ipcheck.proofpoint.comProofpoint IP reputation blockPermanent: retrying will not helpFrom Proofpoint
554 Blocked - see https://ipcheck.proofpoint.com/?ip=203.0.113.5
What it means
Proofpoint filters inbound mail for a large share of enterprises, universities, and public bodies, through its own appliances, its hosted service (MX names under pphosted.com), and Proofpoint Essentials for smaller firms. Before it looks at any message, it scores the IP that connected using its reputation data. When that score is bad enough, the gateway answers with this short 554 line and a link to its ipcheck lookup, with your address filled in.
The verdict is about the IP alone. Your domain, the wording of the email, and your SPF record play no part in this particular refusal, so content changes will not help. The same IP will usually be refused by every other organization that runs Proofpoint, which is why one bounce often turns into dozens across unrelated recipients.
This is different from a 554 5.7.1 policy rejection after DATA, where one customer’s own rules refused the message, and from a 521 refusal in the greeting, where the gateway will not talk to you at all.
Likely causes
- A compromised mailbox, contact form, or script on your server that sent spam in volume.
- An IP on a shared hosting or ESP pool whose neighbours sent junk mail.
- Mail to many invalid recipients at Proofpoint customers, which looks like directory harvesting.
- An IP that recently changed owner and still carries the previous tenant’s history.
- Residential or dynamic address space being used to send mail directly instead of through a smarthost.
How to fix it
- Open the link in the bounce or visit ipcheck.proofpoint.com and enter the IP, so you see exactly which address Proofpoint is judging.
- Stop the bad traffic: reset passwords on accounts with unusual sending, patch web forms, and check that your server is not an open relay.
- Submit the removal request offered on the ipcheck page, explaining briefly what caused the problem and what you changed.
- If the IP belongs to your ESP or hosting company, send them the bounce; only they can clean a shared address.
- Check reverse DNS and other blocklists at the same time, so a second listing does not keep you blocked after Proofpoint clears you.
Checks that apply
- Blacklist Check Reveals whether the IP is also on public DNSBLs such as Spamhaus or Barracuda, which points to real outbound spam.
- Reverse DNS (PTR) Shows whether the IP has a forward-confirmed reverse name, which reputation systems weigh heavily.
- ASN Lookup Tells you who owns the address block, so you know whether to file the removal yourself or ask your provider.
FAQ
- Can the recipient’s admin let my mail through?
- Sometimes. Proofpoint customers can create sender exceptions, but a reputation block at connection time is often enforced before such rules apply, so delisting is the dependable route.
- How long does a Proofpoint removal take?
- Proofpoint does not publish a guaranteed time. Many senders see the block lifted within a day or two of an accepted request, provided no more spam comes from the IP.
- Why am I blocked when my IP is on no public list?
- Proofpoint uses its own data from its customer base, so it can list an IP that public DNSBLs have not caught, or catch it earlier.