ProbeKit
Sign inSign up

550 5.7.23: Microsoft rejected mail for SPF violation

550 5.7.23Sender Policy Framework violationPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com

Example
550 5.7.23 The message was rejected because of Sender Policy Framework violation

What it means

The receiving Exchange Online tenant checked SPF for your envelope sender domain, the result was a fail, and a policy in that tenant rejects SPF failures outright. Mostly this is an anti spam setting such as SPF record: hard fail, or a transport rule acting on the SPF result.

RFC 7372 registers 5.7.23 as SPF validation failed. Microsoft uses the same code with its own wording. By default Exchange Online does not bounce SPF failures; it folds them into spam scoring and DMARC. So a 5.7.23 tells you the recipient made SPF strict on purpose, and that your record does not cover the IP that sent the mail.

Likely causes

  • You send through a service (CRM, ticketing, newsletter) whose IPs are not in your SPF record.
  • Your SPF ends in -all and a new outbound server or provider was never added.
  • The message was forwarded by a third party whose server is not in your SPF, then reached a strict Microsoft tenant.
  • Your SPF record exceeds 10 DNS lookups, so evaluation errors out and strict receivers treat it as a failure.

How to fix it

  1. Find the sending IP in the NDR or the Received headers and identify which service it belongs to.
  2. Add that service to SPF, for example v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net -all.
  3. Keep the total DNS lookups at 10 or fewer; flatten or remove unused includes.
  4. Sign the mail with DKIM for your domain too, so DMARC can pass even when forwarding breaks SPF.

Checks that apply

  • SPF Check Evaluates your SPF record, counts lookups, and shows whether the IP from the bounce is permitted.
  • SPF Generator Builds a corrected record with the missing include and a safe lookup count.
  • DKIM Check Confirms your outbound mail carries a DKIM signature that can rescue DMARC on forwarded paths.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Does Microsoft reject SPF failures by default?
No. The recipient tenant turned on a strict setting or rule. Your SPF still has to include every sender.
Is ~all safer than -all here?
A soft fail is not rejected by the hard fail setting, but it still hurts spam scoring. Fixing the record is the real answer.

Microsoft 365 delist portal Outlook.com SNDS

All 191 bounce codes