Bounce codes › Microsoft 365
550 5.7.23: Rejected because of Sender Policy Framework violation
The recipient's mail system checked whether the server that sent your email is allowed to send for your domain. Your domain's SPF record says it is not.
Fix your sending setup Your email failed authentication
SPF failed for the domain you send from.
- Sent by: Microsoft 365 / Outlook
- Permanent (hard bounce). Sending the same message again fails again.
How Microsoft 365 words it (source):
The message was rejected because of Sender Policy Framework violation
Why it happens
- You started sending through a new service (a newsletter tool, a CRM, a help desk) and did not add it to your SPF record.
- Your SPF record has more than 10 DNS lookups, which makes the whole record fail.
- Your domain has two SPF records. Only one is allowed.
- The message was forwarded, so it arrived from a server your record does not list.
What to do
- Run your domain through the SPF, DMARC and DKIM checker. It shows the record, the lookup count and which services are allowed.
- Add the
include:that your sending service tells you to add. - Merge two SPF records into one.
- Turn on DKIM as well. A message that passes DKIM can still pass DMARC when SPF breaks through forwarding.
Don't confuse it with
550 5.7.509 is a DMARC failure, and 550 5.7.26 is Gmail's code for failed authentication. All three are fixed in your own DNS, not in your list.
Questions
Is the recipient's address wrong?
No. Any address at a domain that checks SPF strictly will bounce the same way until you fix the record.
Who can fix it?
Whoever manages the DNS of the domain in your From address.
Got a different bounce?
Paste the whole message into the bounce code lookup. It reads the code and the words and tells you whose move it is.
Related codes
550 5.7.509Sending domain does not pass DMARC verification (Microsoft 365)550 5.7.26This email has been blocked because the sender is unauthenticated (Gmail)