Fixing "550 5.7.23 SPF validation failed"

550 5.7.23 means the receiving server checked SPF for your domain and the connecting server was not on the authorized list — so it rejected the message outright.

What it means

SPF is a DNS record listing which servers may send as your domain. If the sending IP is not covered — or your SPF is broken — the check fails and strict receivers reject rather than accept-and-flag.

Why it happens

Usually a new sending service (a CRM, a helpdesk, a marketing tool) was never added to SPF. It can also be SPF exceeding the 10-DNS-lookup limit (a permerror many receivers treat as fail), or a forwarding hop that breaks the SPF path.

Diagnose it

The SPF check below fetches your record, expands every include:, counts the lookups against the limit of 10, and shows exactly which mechanism is missing the sending server.

Fix it

1. Add the sending service to a single SPF record (each provider documents its include):

v=spf1 include:_spf.google.com include:your-service.example ~all

2. Keep it to one SPF record and under 10 lookups — flatten includes if you are over (see the lookup-limit guide).

3. For mail that is forwarded, rely on DKIM alignment; SPF cannot survive most forwarding.