550 5.7.23: SPF check failed
The server that sent your message isn't listed in your domain's SPF record, and the receiver rejected it.
Blocked The address is probably fine. The problem is how the mail was sent.
What the bounce message looks like
The wording changes from one provider to another. These are typical examples:
550 5.7.23 The message was rejected because of Sender Policy Framework violation (Microsoft)Common causes
- A new email service that wasn't added to SPF
- Two SPF records on the domain, which makes SPF fail
- More than 10 DNS lookups in the SPF record
- A strict
-allwith a missing service - In Microsoft 365: an on-premises server or relay IP missing from SPF, or outbound mail sent through Microsoft's High Risk Delivery Pool after it was flagged as spam
How to fix it if you sent the email
- Add every service that sends as your domain to one SPF record. Use the SPF generator.
- Check the result with the SPF checker.
If you manage the receiving or sending mail system
- Merge duplicate SPF records into one.
- Remove services you no longer use to stay under 10 lookups.
- In Microsoft 365, make sure the sending domain is added and verified in the tenant. If good mail was wrongly flagged as spam, contact Microsoft Support.
Free tool: paste the full bounce into the bounce message decoder to get a plain-English reading of every code in it.
Questions people ask
- What does 550 5.7.23 mean?
- The server that sent your message isn't listed in your domain's SPF record, and the receiver rejected it.
- Is 550 5.7.23 a hard or soft bounce?
- Blocked. The address is probably fine. The problem is how the mail was sent.
- Should I remove the address after a 5.7.23 bounce?
- No. Fix how the mail is sent; the address itself is probably fine.