ProbeKit
Sign inSign up

5.7.23 bounce: SPF validation failed

5.7.23SPF validation failedPermanent: retrying will not help

Typical wording
550 5.7.23 SPF validation failed

What it means

RFC 7372 assigns X.7.23, “SPF validation failed”, to an SPF check that returned fail. The receiver looked up the SPF record for the envelope sender (MAIL FROM, or HELO when the sender is empty), and that record says your connecting IP is not allowed to send for the domain.

It reports a definite fail, usually from a record ending in `-all`. A softfail (`~all`) is normally not rejected with 5.7.23, and a broken record gives 5.7.24 instead. Microsoft also uses 5.7.23 in its own NDRs for SPF-related rejections.

Since the record is explicit, this is a permanent 5xx. The sender’s domain owner has to fix the record or the sending path; the recipient can only add an exception.

Likely causes

  • A new sending service (CRM, helpdesk, newsletter tool) that was never added to the SPF record.
  • Mail sent from a server whose IP changed after a migration, while SPF still lists the old address.
  • Forwarding: the forwarding server sends with your envelope address but from its own IP.
  • A typo in an include or ip4 mechanism, so the intended range is never matched.

How to fix it

  1. Read the bounce or the receiver’s Authentication-Results to get the IP that failed and the domain checked.
  2. Add the right mechanism for that sender, for example `v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all`.
  3. Keep the record under 10 DNS-querying mechanisms; replace unused includes rather than adding more.
  4. For forwarding, ask the forwarder to use SRS (Sender Rewriting Scheme), and make sure DKIM is in place so DMARC can still pass.

Checks that apply

  • SPF Check Evaluates your SPF record, counts DNS lookups, and shows which IP ranges it allows, the direct answer for a 5.7.23.
  • SPF Generator Builds a corrected SPF record with the services you actually use, without going over the lookup limit.
  • Email Header Analyzer Shows the Received-SPF and Authentication-Results lines with the IP and domain the receiver checked.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Is 5.7.23 the sender’s or the recipient’s problem?
The sender’s. Only the owner of the envelope sender domain can authorise the IP in SPF.
Why does it fail only for forwarded mail?
The forwarder’s IP is not in your SPF record. SRS on the forwarder, or a passing DKIM signature for DMARC, solves it.

All 191 bounce codes