@Mail Domain Check

Cloudflare Email Service | Proofpoint | SMTP 554

Cloudflare Email Service: Proofpoint 554 blocked

A Proofpoint reply that names Cloudflare's outbound IP is a reputation rejection for that SMTP attempt. Verify the provider-specific cf-bounce authentication records separately, then route the IP action to the party that controls the shared sending pool.

What the 554 proves

Proofpoint documents 554 Blocked as a block on the connecting IP and/or domain after spam or malicious-activity signals. SMTP 554 is a permanent failure for this delivery attempt. It does not, by itself, prove an application bug, a missing visible-From SPF record, a bad magic link, or a provider-wide outage.

Proved
The specific route and outbound IP named in the rejection did not deliver this recipient attempt.
Not proved
One rejection does not establish failure at Gmail, Outlook, iCloud, or every Proofpoint tenant.
Retry stance
Do not loop an unchanged message through the same blocked route. A fresh attempt needs a changed, approved route or evidence that the block is cleared.
Ownership
Cloudflare controls its shared outbound pool. The customer controls sender configuration, event correlation, user recovery, and any decision to migrate.

Check Cloudflare's real authentication boundary

Cloudflare Email Service publishes sending authentication on a provider-managed bounce subdomain. A scanner that checks only the visible From hostname can therefore report missing SPF even while the actual Cloudflare envelope path is configured correctly.

  • SPF: query cf-bounce.yourdomain.example, not just yourdomain.example.
  • DKIM: query selector cf-bounce at cf-bounce._domainkey.yourdomain.example.
  • DMARC: query _dmarc.yourdomain.example and verify that either the real envelope identity or DKIM signing identity aligns with the visible From domain.
  • Bounce routing: confirm the provider-managed MX records on cf-bounce.yourdomain.example.

Cloudflare's postmaster documentation says outbound Email Service mail is authenticated with SPF and DKIM. DNS presence is still not proof that one rejected message passed authentication; use the actual Return-Path, DKIM d=/s=, and receiver result when a delivered comparison message is available.

Preserve a bounded evidence packet

  1. Keep the complete SMTP code and text, rejected outbound IP, recipient MX domain, UTC timestamp, Cloudflare event or message ID, and sending-domain configuration state.
  2. Record whether Cloudflare reports the event as bounced or rejected. Do not collapse API submission success into final delivery.
  3. Verify the exact cf-bounce SPF, DKIM, and MX names plus DMARC. Record pass/fail only; do not publish private message content or recipient data.
  4. Check PTR and forward DNS for the rejected IP. A matching PTR is useful ownership evidence, but it does not override Proofpoint's reputation verdict.

Do not publish a recipient address, magic link, OTP, account identifier, Cloudflare API token, Worker secret, message body, or unredacted provider event.

Correlate the complete delivery lifecycle

The current Workers Email Sending API returns an EmailSendResult with a messageId. Preserve that opaque ID when the binding accepts a submission; do not discard it or treat it as proof of delivery. Cloudflare Email Sending event subscriptions can then publish the later outcome to a Queue.

  1. Subscribe the enabled sending domain to message.delivered, message.deferred, message.bounced, message.failed, message.rejected, and message.complained.
  2. Use each event's eventId for idempotency and correlate its messageId with the original application attempt.
  3. Store only bounded status, terminal state, provider class, SMTP status, and timing fields. Keep recipient addresses, subjects, message bodies, and magic-link URLs out of shared logs.
  4. Retry a temporary message.deferred outcome only under the provider's policy. A terminal Proofpoint 554 remains a permanent route failure until the route or block state changes.

Lifecycle events close the evidence gap between Worker submission and the recipient server's final response. They do not prove inbox placement after a message.delivered event.

Escalate at the shared-IP boundary

Proofpoint's IP-block FAQ tells users of a shared email service to work proactively with that provider. The shared provider can inspect pool traffic, correlate other complaints, rotate or remediate the route, and submit the relevant reputation request. A customer cannot repair a provider-owned IP by adding an unrelated SPF record or repeatedly submitting the same message.

  1. Give Cloudflare the exact 554 reply, outbound IP, event ID, UTC timestamp, recipient MX domain, and a statement that this was consented transactional traffic.
  2. Use Proofpoint's IP check for current public status. If the IP is not shown as blocked but one protected organization still rejects it, that recipient organization's mail administrator must inspect its local policy and can escalate through its authorized Proofpoint support contact.
  3. Do not ask a recipient to weaken organization-wide anti-spam controls as the primary repair. A narrow allow rule can be a temporary business decision owned by that organization, not proof that sender reputation is healthy.

Test the target segment, not a random mailbox

A successful message to one mainstream mailbox does not disprove a Proofpoint-specific block. Build a small, consented matrix that reflects the product's actual users.

  • Use one controlled recipient for each important receiver class: Proofpoint-protected enterprise, Gmail, Microsoft consumer, and any other material customer domain.
  • Give each attempt a new opaque correlation ID and record provider submission, SMTP outcome, receiver acceptance, and inbox visibility as separate states.
  • Change one variable at a time. Do not rotate content, sender, route, and recipient together and then claim a cause.
  • Base migration on repeated hard-bounce evidence in the target segment, not one isolated mailbox and not inbox placement alone.

Protect the magic-link product path

Magic-link and verification systems need an asynchronous failure state. If the provider later records a permanent bounce, mark that attempt failed, stop automatic unchanged retries, expose a safe resend state, and keep an alternate approved login or recovery path available. Invalidate superseded links according to the product's security model.

If the target segment repeatedly rejects the shared route, migrate behind a small provider interface and verify the replacement's Return-Path, DKIM identity, DMARC alignment, bounce webhook, suppression behavior, and event correlation before switching production traffic. Provider submission success still must not be labeled delivered.

Controlled recovery

  1. Confirm the current Cloudflare domain configuration and preserve the rejected event.
  2. Complete the provider-owned reputation action or approve a replacement route.
  3. Send one fresh, consented message with a new correlation ID to the affected receiver class.
  4. Require receiver acceptance before restoring that route. Record inbox visibility separately.
  5. Keep hard-bounce and delayed-event monitoring active so the application cannot report a later 554 as success.

Primary references