550 5.7.24: the sending domain's SPF record has suspicious entries
Gmail rejected (550) or temporarily rate limited (451 4.7.24) your mail because the sending domain's SPF record has one or more suspicious entries.
550 5.7.24 The SPF record of the sending domain has one or more suspicious entries.
The 5.7.24 message in Google's Gmail SMTP errors and codes reference, without its closing link to the sender guidelines.
What 550 5.7.24 means
Google lists 451 4.7.24, which says the SPF record of the sending domain has one or more suspicious entries and that email from your IP has been temporarily rate limited, and 550 5.7.24, which rejects for the same reason. Google doesn't define "suspicious" further, so treat it as a signal to review the whole record.
The standard meaning lines up. RFC 7372 registers X.7.24 as "SPF validation error": SPF evaluation for the arriving message resulted in an error, used in place of the older codes RFC 7208 describes for SPF temporary and permanent errors. RFC 7208 defines a permerror as a record that can't be correctly interpreted, for example because of syntax errors or exceeding the processing limits.
In practice, check for more than one SPF record, typos in mechanisms, includes that point to domains with no SPF record, more than 10 DNS-querying lookups, and broad entries that authorize far more of the internet than you use. Remove includes for services you no longer use. A short, accurate record is easier for every receiver to evaluate.
Likely causes
- Syntax errors, unknown mechanisms or typos in the SPF record.
- More than one SPF record on the domain.
- Too many DNS lookups, or includes that point to missing records.
- Overly broad entries that authorize very large IP ranges.
How to fix it
If you sent the message
- Run the domain through an SPF checker and fix every error it reports.
- Merge duplicate records into one and remove includes for services you no longer use.
- Keep the record under 10 DNS lookups.
- Replace very broad ip4/ip6 ranges with the specific addresses or provider includes you need.
If you're the recipient or their admin
- No action needed at Gmail: the sender has to clean up their SPF record.
Frequently asked questions
What makes an SPF entry suspicious to Gmail?
Google doesn't publish a definition. Treat the error as a prompt to review the whole record: syntax errors, duplicate records, too many lookups, includes for unused services and very broad IP ranges are the usual problems.
Is 451 4.7.24 a bounce?
Not yet. It's a temporary rate limit, so your server keeps the message and retries. If the record isn't fixed, the retries keep failing and the message eventually bounces.
Sources
- Gmail SMTP errors and codes (Google Workspace Admin Help)
- RFC 7372: Email Authentication Status Codes
- RFC 7208: Sender Policy Framework (SPF)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
- 550 5.7.27 550 5.7.27: Gmail blocked a message that didn't pass SPF
- 550 5.7.23 550 5.7.23: SPF validation failed
- 550 5.7.26 550 5.7.26: Gmail blocked an unauthenticated message
- 550 5.7.40 550 5.7.40: Gmail blocked mail from a domain without a DMARC policy
- 550 5.7.28 550 5.7.28: unusual rate of unsolicited email from your IP
- 550 5.7.29 550 5.7.29: Gmail blocked a message not sent over TLS
- 550 5.2.1 550 5.2.1: the email account that you tried to reach is inactive
Related guides
Multiple SPF records found: why it causes PermError and how to merge them
Why a domain can have only one v=spf1 record, how two SPF records cause PermError and break DMARC, and how to merge them into one record safely, step by step.
8 min read SPF, DKIM & DMARCHow to fix SPF PermError: too many DNS lookups
Why SPF breaks at 10 DNS lookups, how to count them, and step-by-step fixes for Microsoft 365 and Google Workspace domains with many senders.
8 min read SPF, DKIM & DMARCSPF record syntax and examples
SPF record syntax explained: mechanisms, qualifiers and modifiers, with copy-ready examples for Microsoft 365, Google Workspace, subdomains and parked domains.
9 min read SPF, DKIM & DMARCWhat is SPF, and how does an SPF record work?
What an SPF record is, how receivers check it against the envelope sender, the 10-lookup limit, what SPF can't do, and how to create one for your domain.
9 min read