The IP you are reporting is delayed or blocked because we have indications that messages scoring as spam or virus are being received from the IP. We do not delay or block based on a particular domain or bulk email or for any reason other than we are receiving spam from the IP.

Proofpoint Dynamic Reputation uses hundreds of features to determine the reputation of a particular IP. Features indicating that an IP is sending spam, and is not an actual mail server for a legitimate company, will cause the IP to have a poor reputation and the IP will become delayed or blocked.

An IP that presents indications of spam may be delayed for a short time. You do not need to do anything to get your IP removed from delay status; this will happen automatically, usually within a few minutes.

An IP that continuously sends spam to our systems will be blocked and remain blocked. Once an IP stops sending spam for a period of time, it will be removed from the block list. If we receive intermittent spam from an IP (e.g. a public access point where infected machines may come and go), the IP may fluctuate between delayed and not delayed, or blocked and not blocked.

If you are aware of any recent problems on your network (e.g. you have just removed an infected computer), include that in your request. Also include information and supporting data as shown below so we can evaluate and verify your request. The more information you provide, the faster we can evaluate the issue. Help us help you because we take pride in maintaining an accurate reputation system.

Here's the information we'll need from you:

• Recipient of blocked email
• Type of email blocked
  • Personal correspondence
  • Newsletters
  • Company communications
  • If company communications
    • type of company and what your company does - ISP, small business, etc.

We strive to review submitted reports within one business day.

Keep your operating system, anti-virus and anti-spam software up to date to prevent getting infected again. Be aware of suspicious emails and think twice before clicking links.

If you are using a shared email service, be proactive with your provider to ensure they are keeping their anti-virus and anti-spam software up to date. If they do not scan outbound email, it is possible that anyone on their service can knowingly or unknowingly send spam and cause everyone to get blocked.

If you are running your own email server, be sure you have outbound mail protection to avoid unknowingly sending spam and becoming delayed or blocked.
If your email server's reverse DNS pointer is controlled by your ISP, ask that it reflect your mail server's host name.

If you do not know what IP address to lookup, check the email 'reject' message. The IP address is a series of four numbers separated by dots (like '1.2.3.4') and is normally visible in the mail rejection message you received. A 'reject' message from a server that uses the Proofpoint Email Security solution typically looks like this:

550 5.7.1 Email rejected because 1.2.3.4 is listed by Proofpoint.com

If you can't find what IP address to lookup, or you are not sure what an IP address is, please contact your local network administrator or your ISP for assistance.