Microsoft 365 550 5.7.23 "Sender Policy Framework Violation": Causes and Fix

550 5.7.23 is Microsoft 365 rejecting a message because it failed SPF. The text reads "The message was rejected because of Sender Policy Framework violation." The recipient's tenant enforces SPF, and the IP that sent your mail is not authorised by your domain's SPF record.

The 550 5.7.23 code page has the short answer.

Reading the code

Part	Value	Meaning
Reply code	550	Requested action not taken
Class	5	Permanent failure
Subject	7	Security or policy status
Detail	23	SPF validation failed

The class and subject come from RFC 3463, and RFC 7372 added 5.7.23 for a failed SPF validation.

Why SPF fails

• A sending service is missing from your SPF record. A new tool started sending as your domain and was never added.
• The record ends in -all and mail went out from an IP it does not list.
• The message was forwarded by a server that is not in your SPF record.
• The record has a syntax error or too many DNS lookups. SPF allows 10; see SPF too many DNS lookups. Two SPF records on one domain also fail, covered in combining services into one SPF record.

How to fix it

1. Find the sending IP in the bounce, using the email header analyzer on a copy of the message if you have one.
2. Read your SPF record and count the lookups with the SPF lookup counter.
3. Add every service that sends as your domain, merging into a single record. The SPF record merger helps.
4. Set up DKIM so DMARC can pass even when forwarding breaks SPF. SPF, DKIM and DMARC explained shows how the three fit together.
5. Check across all your sending domains. Monitoring sending domains for SPF, DKIM and DMARC covers the routine.

Related Microsoft codes

The same family includes 550 5.7.509 for DMARC and 550 5.7.515 for authentication. The Outlook bounce codes page covers more.

What this does not do

The record fix is on your domain's DNS, so there is nothing to change in your list. Public DNS can serve a cached answer for up to the record's TTL, so a corrected record may take a while to take effect.

Keep the address side clean

This code does not come from your list, but every bounce still counts against your sending reputation, so the addresses you do send to should be real. Upload your list on the verify page: the first 100 email checks are free with a Google sign-in, no card. Each address comes back valid, risky or invalid with a reason such as "Mailbox not found" or "Accepts all addresses", and nothing is sent to anyone on the list. For larger or recurring lists, see bulk email verification, list cleaning and pricing.