# 550 5.7.23: SPF validation failed

URL: https://iblockspam.com/smtp-errors/550-5-7-23
Last updated: 2026-10-09

Code: 550 5.7.23 (permanent failure, the message bounced)
Provider: Standard (RFC)

The receiver checked your domain's SPF record and the sending server wasn't authorized, so the message was rejected under its policy.

RFC 7372 registered X.7.23, "SPF validation failed": the message completed an SPF check that produced a "fail" result, contrary to local policy. It replaces the generic 5.7.1 for this case, as described in section 8.4 of RFC 7208 (SPF). A related code, X.7.24, "SPF validation error", is used when evaluating SPF produced an error rather than a clean result.

An SPF fail means the IP address that delivered the message isn't covered by the SPF record of the envelope sender's domain, and the record ends in a hard fail ("-all"). The usual reason is a new sending service, a website, CRM or scanner, that was never added to the record.

Microsoft documents 550 5.7.23 too. It says this bounce most likely means an SPF configuration problem, and tells admins to verify the domain's SPF record, include any on-premises IPs that send for the domain, and check whether the message went out through Microsoft's High Risk Delivery Pool, since messages sent that way won't pass SPF.

## Common causes

- A service that sends as your domain isn't listed in your SPF record.
- The SPF record has a typo or a broken include.
- The message was forwarded, so it arrived from a server your SPF record doesn't list.
- An outbound message was routed through a high-risk sending pool after being flagged as spam.

## How to fix it (sender)

- Check your SPF record and confirm every service that sends as your domain is included.
- Keep the record under SPF's 10 DNS-lookup limit.
- Set up DKIM as well, so forwarded mail can still pass DMARC.

## How to fix it (recipient or admin)

- If mail forwarded into your domain fails SPF, accept it through a trusted forwarder or ARC instead of loosening SPF checks.

**Q: How do I find which server failed SPF?**
The bounce or the recipient's Authentication-Results header shows the connecting IP address. Compare it with the services listed in your SPF record; an SPF checker shows the full list of addresses the record allows.

**Q: Should I change -all to ~all to stop 5.7.23 bounces?**
That hides the problem rather than fixing it, and some receivers treat softfail as suspicious anyway. Add the missing sender to your SPF record and set up DKIM instead.

Sources:
- RFC 7372: Email Authentication Status Codes: https://www.rfc-editor.org/rfc/rfc7372
- IANA: SMTP Enhanced Status Codes registry: https://www.iana.org/assignments/smtp-enhanced-status-codes/smtp-enhanced-status-codes.xhtml
- Fix NDR error "550 5.7.23" in Exchange Online (Microsoft Learn): https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/fix-error-code-5-7-23-in-exchange-online

---

Source: iBlockSpam, https://iblockspam.com/smtp-errors/550-5-7-23 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt