Mimecast is one of the most common enterprise email security gateways. When a company routes inbound mail through Mimecast, their MX records resolve to mimecast.com servers. Mimecast uses standard SMTP enhanced codes, but adds its own policy and reputation filtering on top — and every company can configure their own rules, which means the same IP can be accepted by one Mimecast customer and blocked by another.
If the Remote-MTA in your bounce contains a hostname ending in mimecast.com (such as us-smtp-inbound-1.mimecast.com), the rejection came from Mimecast. Mimecast includes the string smtp; in its diagnostic codes, and often appends an IP address and a numeric identifier in square brackets.
Remote-MTA: dns; us-smtp-inbound-1.mimecast.com Diagnostic-Code: smtp; 550-5.7.1 [198.51.100.1 12] Message rejected. See https://www.mimecast.com/products/email-security/faq/ for more info.
The mimecast.com MX hostname is the key identifier. The numeric code in brackets (e.g. [198.51.100.1 12]) is an internal Mimecast reference — the IP is your sending IP and the number is Mimecast's rejection reason code.
Mimecast appends a numeric reason code in square brackets after the sending IP in rejection messages. These codes identify the category of rejection:
The most common SMTP errors returned by Mimecast Email Security gateways.
If Mimecast is blocking your IP or domain, follow these steps before requesting review:
Common questions about Mimecast gateway SMTP errors.
Look up the MX records for the recipient domain using our MX Inspector. If they resolve to hostnames ending in mimecast.com — like us-smtp-inbound-1.mimecast.com — Mimecast is handling their inbound mail. This tells you which filtering system you are dealing with and what delist steps are relevant.
This is what's known as a delayed bounce, and it happens because Mimecast accepted the message on behalf of the recipient at the SMTP level, but then a downstream system — usually the actual mail server like Exchange — rejected it during processing. The bounce email still comes from the Mimecast MX hostname, which can be confusing. Look at the enhanced status code inside the bounce for the real reason.
Yes, and this is the key thing to understand about Mimecast: every company that uses it gets to configure their own rules. That means your IP or domain might be perfectly fine for one Mimecast customer and blocked by another — not because of your reputation globally, but because their IT admin has set a stricter policy. If you are being blocked by a specific organisation, the fastest fix is to ask the recipient's IT admin to whitelist your IP or domain directly in their Mimecast console.
Work through this in order. First, check your authentication — run your domain through our Domain Checker to confirm SPF, DKIM, and DMARC are correct. Second, check your IP reputation with our Blacklist Checker — Mimecast respects major IP blocklists like Spamhaus and Spamcop, so if you are listed there, get delisted first. Third, check your reverse DNS (PTR) record — Mimecast is known to reject senders that do not have a valid PTR matching their sending hostname.
Paste your full NDR email or SMTP error line for an instant plain-English diagnosis.
Open the Bounce Decoder →