Proofpoint is one of the most widely deployed enterprise email security gateways. When a company puts Proofpoint in front of their mailboxes, their MX records resolve to pphosted.com servers. Proofpoint uses standard SMTP codes, but applies its own layered spam, content, and reputation checks on top — and it often cites third-party reputation services like Spamhaus or Cloudmark directly in the bounce text.
If the Remote-MTA or Reporting-MTA in your bounce contains pphosted.com, the rejection came from a Proofpoint gateway. Proofpoint uses standard SMTP codes (550, 421, etc.) with descriptive human-readable text. The diagnostic often references a third-party reputation service (like Spamhaus or Cloudmark) or a Proofpoint-internal policy rule.
Remote-MTA: dns; mx1-us1.ppe-hosted.com Diagnostic-Code: smtp; 550 5.7.1 Service unavailable; Client host [198.51.100.1] blocked using Cloudmark Sender Intelligence; To request removal from this list please forward this message to: [email protected]
The pphosted.com or ppe-hosted.com MX hostname is the key Proofpoint identifier. Note that Proofpoint often cites the underlying reputation service (Cloudmark, Spamhaus) in the rejection text — follow that service's delist process, not Proofpoint's.
The most common SMTP errors returned by Proofpoint Email Protection gateways.
Proofpoint aggregates multiple third-party and proprietary reputation sources. When your IP or domain is blocked, the diagnostic text usually tells you which reputation service triggered the block:
[email protected] or the Cloudmark Sender Intelligence portal.Common questions about Proofpoint gateway SMTP errors.
Look up the MX records for the recipient domain. If they resolve to hostnames ending in pphosted.com or ppe-hosted.com, Proofpoint is in front of their inbox. You can do this quickly with our MX Inspector. Knowing the recipient is behind Proofpoint tells you a lot about what to expect and which delist processes to use.
Proofpoint does not just use its own filters — it queries several third-party reputation services as part of its connection checks. When one of those lists flags your IP or domain, Proofpoint includes the service's name (and sometimes a delist link) right in the rejection message. This is actually helpful: it tells you exactly where to go. Delist from the cited service — Spamhaus, Cloudmark, or whichever is named — and Proofpoint will stop blocking you automatically. You do not need to contact Proofpoint.
Proofpoint does not have a public sender portal the way Google or Microsoft do. If the bounce message names Spamhaus, Cloudmark, or another third-party service, contact them — not Proofpoint. If the rejection text references Proofpoint's own Nexus reputation system, you can submit a sender review request through the Proofpoint support portal, but be prepared for a longer process than third-party delist requests.
Yes, and this is an important distinction. Proofpoint is not the mailbox — it is a filter that sits in front of the mailbox (usually Microsoft 365, Google Workspace, or an Exchange server). It applies its own checks before the message ever reaches Microsoft or Google's systems. This is why you can pass all of Microsoft's authentication checks and still get bounced: the company has stricter custom rules in their Proofpoint configuration that Microsoft's own systems know nothing about.
Paste your full NDR email or SMTP error line for an instant plain-English diagnosis.
Open the Bounce Decoder →