community.mimecast.com Open in urlscan Pro
160.8.4.13  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Loading
×Sorry to interrupt
CSS Error

Refresh
Skip to NavigationSkip to Main Content
Toggle SideBar
Customer Community

Search...
Loading...


Login
 * Home
 * Knowledge & Enablement
    * Knowledge Base
    * Product Enablement Hubs

 * Support
    * Support Hub
    * Application Downloads
    * Product Life Cycle

 * Status Page
 * More


MIMECAST SMTP ERROR CODES

MIMECAST SMTP ERROR CODES

JUN 17, 2022•KNOWLEDGE


FIELDS

Title
Mimecast SMTP Error Codes



ARTICLE DETAILS

Content

When messages are sent or received between two email servers or Mail Transfer
Agents (MTAs), the communication uses a series of numeric SMTP codes. These
codes are always in pairs, which means both servers transmit the codes until
either the conversation is successful or fails.

There are two main code types for dropped or failed SMTP conversations. The
first number in a code indicates whether the MTA accepted the command, or if it
was rejected. The remaining two numbers in a code provide information on the
reason for the failure. The code types are:

 * 4xx: The server encountered a temporary failure. If the command is repeated
   without being changed, it may be successful depending on the reason for the
   initial failure. Mail servers use temporary failures to hold connections from
   untrusted sources, while additional security checks are performed. See the
   SMTP 4xx Error Codes section below for a full list of error codes.
 * 5xx: The server has encountered a permanent error and the message delivery
   has failed. If you receive any of the errors listed below when sending a
   message to a Mimecast customer, contact the recipient's Mimecast
   Administrator. Mimecast can only deal with designated customer contacts. See
   the SMTP 5xx Error Codes section below for a full list of error codes.


SMTP 4X ERROR CODES

A 4xx error is returned if the server encountered a temporary failure. If the
command is repeated without being changed, it may be successful depending on the
reason for the initial failure. Mail servers use temporary failures to hold
connections from untrusted sources, while additional security checks are
performed.

A correctly configured mail server should retry sending a message if a 4xx error
code is received. These connections are logged in the Message Center: Rejected
and Deferred Messages list.

Note: If you receive any of the errors listed below when sending a message to a
Mimecast customer, contact the recipient's Mimecast Administrator. Mimecast can
only deal with designated customer contacts.

+

CodeReason Given to Sending MTADescriptionRecommended Resolution421 Sender
address blocked The sender's IP address has been blocked by a Blocked Senders
Policy. Remove the entry from the policy.451 Unable to process connection at
this time The Mimecast server is under maximum load. No action is required from
the end-user. The message will retry 30 times and when server resources are
available, the message is processed.
 451 Internal resources are temporarily unavailable The sending mail server is
subjected to Greylisting. This requires the server to retry the connection,
between one minute and 12 hours. Alternatively, the sender's IP address has a
poor reputation. These reputation checks can be bypassed with an Auto Allow or
Permitted Senders policy. If it's legitimate traffic, amend your Greylisting
policy.

451

 Message ended early

 The message was incorrectly terminated. This can be caused by:

 * Files that previously contained a virus, but haven't been cleaned by an
   anti-virus product, leaving traces in the message.
 * Firewall issues on the sender's side.
 * Incorrectly configured content rules on a security device.

 Investigate the Intrusion Detection software or other SMTP protocol analyzers.
If running a Cisco Firewall, ensure the Mail- guard or SMTP Fixup module is
disabled.

451Open relay not allowed Both the sender and recipient domains specified in the
transmission are external to Mimecast, and aren't allowed to relay through the
Mimecast service and/or the connecting IP address isn't recognized as
authorized. Mimecast customers should contact Mimecast Support to add the
Authorized Outbound address, or to take other remedial action.451Account
outbounds disabled The customer account outbound emails are disabled in the
Administration Console.  Contact Mimecast Support if the account's outbound
traffic should be allowed.451Account inbounds disabled The customer account
Inbound emails are disabled in the Administration Console.  Contact Mimecast
Support if the account's inbound traffic should be allowed.451Account service is
temporarily unavailable  There are too many concurrent inbound connections for
the account. The default is 20.  The IP address is automatically removed from
the block list after five minutes. Continued invalid connections result in the
IP being readded to the block list. Ensure you don't route outbound or journal
messages to Mimecast from an IP address that hasn't been authorized to do
so.451Recipient Temporarily Unavailable The Sender's IP address has been placed
on the block list due to too many invalid connections. The sender's mail server
must retry the connection. The mail server performing the connection says the
recipient address validation isn't responding.451Unable to process
command Generic error if the reason is unknown Contact Mimecast
Support.451Unable to process an email at this time Generic error if the reason
is unknown Contact Mimecast Support.451IP Temporarily Blacklisted You've reached
your mail server's limit. Wait and try again. The mail server won't accept any
messages until you're under the limit.451Hostname is not authorized Omni
Directional hostnames are enabled. Disable Omni Directional hostnames.452Too
many recipients The sending server issues more than 100 RCPT TO entries. By
default, Mimecast only accepts 100 RCPT TO entries per message body (DATA). The
error triggers the sending mail server to provide the DATA for the first 100
recipients before it provides the next batch of RCPT TO entries.  Most mail
servers respect the transient error and treat it as a "truncation request". If
your mail server, firewall, or on-site solution doesn't respect the error, you-
must ensure that no more than 100 recipients are submitted.

 Note: Solutions like SMTP Fix-Up / MailGuard and ESMTP inspection on Cisco Pix
and ASA Firewalls are known not to respect the transient error. We advise you to
disable this functionality.

These SMTP codes and reasons are communicated to the sending MTA. For a
permanent failure, these details must be included in the Non-Delivery Report
(NDR) generated by that mail server.


SMTP 5XX ERROR CODES

A 5xx error time is returned if the server has encountered a permanent error and
the message depend-user has failed. If you receive the errors listed below when
sending a message to a Mimecast customer, contact the recipient's Mimecast
Administrator. Mimecast can only deal with designated customer contacts.

Error 5xx codes are peto retry failures. These connections are rejected in the
protocol, and, the connection is logged in the Rejection Viewer. As the message
is rejected in the protocol, it isn't retrievable from the Administration
Console and must be resent once the issue is addressed.

CodeReason Given to Sending MTADescriptionRecommended Resolution501Invalid
address The email address isn't a valid SMTP address. The sender must resend the
message to a valid internal email address.503User unknown The server has
encountered a bad sequence of commands, or it requires an authentication. In
case of a "bad sequence", the server has pulled off its commands in the wrong
order, usually because of a broken connection. If authentication is needed,
enter your username and password.535Incorrect authentication data Messages
submitted to SMTP port 587 require authentication. This error indicates the
authentication details provided were incorrect. Check your authentication
details match an internal email address in Mimecast, with a corresponding
Mimecast cloud password. Alternatively, consider sending the message on SMTP
port 25.550Submitter failed to disabled550Administrative prohibition envelope
blocked The sender's email address or domain has triggered a Blocked Senders
Policy or there's an SPF hard rejection. Delete or modify the Blocked Senders
policy to exclude the sender address.550Anti-Spoofing policy - Inbound not
allowed The message has triggered an Anti-Spoofing policy. Create an
Anti-Spoofing policy to take no action for the sender's address or IP
address.550Rejected by header-based Anti-Spoofing policy550Envelope blocked –
User Entry A personal block policy is in place for the email
address/domain. Remove the email address/domain from the Managed Senders
list.550Envelope blocked – User Domain Entry550Rejected by header-based manually
Blocked Senders - block for manual block550Rejected by header-based Blocked
Senders - Block policy for Header From A Block Sender Policy has been applied to
reject emails based on the Header From or Envelope From address. Delete or
change the Blocked Senders policy.550Envelope Rejected - Block policy for
Envelope from address550< details of RBL > The sender's IP address is listed in
an RBL. The text displayed is specific to the RBL which lists the sender's IP
address. Bypass the RBL with an Auto Allow or Permitted Senders policy.
Additionally request the associated IP address from the RBL.550Local CT IP
Reputation - (reject) Ongoing reputation checks have resulted in the message
being rejected due to poor IP reputation. This could occur after a 4xx
error. Create an Auto Allow or Permitted Senders policy.

Note: You can request a review of your source IP ranges by completing our online
form.

550Invalid Recipient Known recipient, LDAP, or SMTP call forwarding recipient
validation checks haven't returned a valid internal user. The sender must resend
the message to a valid internal recipient address.550Exceeding outbound thread
limit There are too many concurrent outbound connections for the account. Send
the messages in smaller chunks to recipients.550Message bounced due to Content
Examination Policy The message has triggered a Content Examination
policy. Either create a Content Examination Bypass policy or adjust the Content
Examination policy as required.550SPF Sender Invalid - envelope rejected The
inbound message has been rejected because the originated IP address isn't listed
in the published SPF records for the sending domain. Ensure all the IP addresses
for your mail servers are listed in your SPF records. Alternatively, create a
DNS Authentication (Inbound / Outbound) policy with the "Inbound SPF" or "Reject
on Hard Fail" option disabled. Messages that fail our SPF checks are subjected
to spam and RBL checks, instead of being rejected.550DKIM Sender Invalid -
envelope rejected The DKIM key for the outbound message is broken and doesn't
match the DNS record of the registered sender. Check your organization's DNS
record is populated with the right public key as part of the DNS Authentication
Outbound Signing definition. The private key of the keypair must be populated in
the DNS Authentication policy, along with the domain and selector of that
record.550DMARC Sender Invalid - envelope rejected The inbound message has been
rejected because the originated IP address isn't listed in the published SPF
records for the sending domain. Ensure all the IP addresses for your mail
servers are listed in your SPF records.550Journal message past
expiration Atteiss is being made to journal mail that is past the set expiry
threshold. The failure will be replaced by a retry response because the message
is marked for retry if rejected, causing the journal queue to grow. Check to
confirm there are no significant time discrepancies on the mail server.
Discontinue journaling old messages past the expiry threshold.553This route
requires encryption (TLS) This email has been sent using SMTP, but TLS is
required by policy. Delete or change the Secure Receipt or Secure Delivery
policy enforcing TLS. Alternatively, ensure the certificates on the mail server
haven't expired. If using a proxy server, ensure it isn't intercepting the
traffic and modifying encryption parameters.553This route requires TLS version
1.2 or greater A TLS connection has been attempted using a TLS version that is
lower than TLS 1.2. Delete or change the Secure Receipt or Secure Delivery
policy enforcing TLS. Alternatively, ensure the mail server attempting to
connect is using the appropriate version of TLS.553This route requires
high-strength ciphers A secure connection was attempted using ciphers that do
not meet the configured cipher strength. Delete or change the Secure Receipt or
Secure Delivery policy enforcing TLS. Alternatively, ensure the certificates on
the mail server haven't expired. If using a proxy server, ensure it isn't
intercepting the traffic and modifying encryption parameters.554Email rejected
due to security policies (e.g. MCSpamSignature.x.x) A signature was detected
that could either be a virus, or a spam score over the maximum threshold. The
spam score isn't available in the Administration Console. If you aren't a
Mimecast customer but have emails rejected with this error code, contact the
recipient to adjust their configuration and permit your address. If
unsuccessful, your IT department can- submit a request to review these email
rejections via our Sender Feedback form. Anti-virus checks cannot be bypassed.
Contact the sender to see if they can stop these messages from being blocked.
Anti-spam checks can be bypassed using a Permitted Senders or Auto Allow policy.
Rejected emails can be viewed in your Outbound Activity and searching for the
required email address.554Mail loop detected The message has too many "received
headers" as it has been forwarded across multiple hops. Once 25 hops have been
reached, the email is rejected. Investigate the email addresses in the
communication pairs, to see what forwarders are configured on the mail
servers.554Maximum email size exceeded The email size either exceeds an Email
Size Limit policy or is larger than the Mimecast service limit. The default is
100 MB for the Legacy MTA, and 200 MB for "the Latest MTA". Resend the message
ensuring it's smaller than the limitation set. The transmission and
content-encoding can add significantly to the total message size (e.g. a message
with a 70 MB attachment, can have an overall size larger than 100 MB).554Host
network, not allowed The message has triggered a Geographical Restriction
policy. Delete or amend the policy.554Configuration is invalid for this
certificate Validation on your umbrella account's domain name does not conform
to your DNS. Check you DNS has the required umbrella accounts listed as
comma-separated values.

These SMTP codes and reasons are communicated to the sending MTA. For a
permanent failure, these details must be included in the Non-Delivery Report
(NDR) generated by that mail server.


ARTICLE PROPERTIES

Article Created Date
11/7/2019 10:05 PM
URL Name
Mimecast-SMTP-Error-Codes-842605754
Last Published Date
6/17/2022 8:23 AM

Managing Your AccountMonitoring Message Delivery



WAS THIS ARTICLE HELPFUL?





Choose a general reason
Select an Option


Description

Submit


CAN'T FIND WHAT YOU'RE LOOKING FOR?


Don't see what you're looking for?
Ask a Question
Contact Support


EXPLORE THE PRODUCT
ENABLEMENT HUBS

Organized guides for every product. Get set up, optimize your settings,
integrate with your security environment, troubleshoot and more.



Explore


TAKE YOUR “MIMECASTERY” TO THE NEXT LEVEL

Instructor-led courses and certification on all things Mimecast, available for a
low annual subscription rate.



LEARN MORE

Home

Knowledge Base

Support

Privacy

Acceptable Use


© 2020 Mimecast Services limited.





Loading



This website uses cookies in order to provide you with the best possible
experience and to monitor and improve the performance of the site. We have
published a new cookie policy which explains what cookies are and which types of
cookies this website uses. By continuing to use this site, you are agreeing to
the use of cookies, unless you have disabled them. Privacy Statement

Cookies Settings Accept All Cookies