Permanent failure — do not retry
SMTP 550 5.7.23
SPF violation (Microsoft 365)
SMTP 550 5.7.23 is Microsoft 365 rejecting a message because of an SPF failure. The text reads "The message was rejected because of Sender Policy Framework violation." The recipient's tenant enforces SPF, and the IP that sent your mail is not authorised by your domain's SPF record.
How it appears
550 5.7.23 The message was rejected because of Sender Policy Framework violation
What causes it
- A sending service is missing from your SPF record.
- The SPF record ends in -all and mail went out from an IP it does not list.
- The message was forwarded by a server that is not in your SPF record.
- The SPF record has a syntax error or too many DNS lookups.
How to fix it
In order — try the first one first.
- Add every service that sends as your domain to the SPF record.
- Check the record for syntax errors and keep it under 10 lookups.
- Set up DKIM so DMARC can pass even when forwarding breaks SPF.
Common questions
- What does SMTP 550 5.7.23 mean?
- SMTP 550 5.7.23 is Microsoft 365 rejecting a message because of an SPF failure. The text reads "The message was rejected because of Sender Policy Framework violation." The recipient's tenant enforces SPF, and the IP that sent your mail is not authorised by your domain's SPF record.
- Should I retry a 550 5.7.23 error?
- No. 550 is a permanent failure, so the message will never be delivered no matter how many times you try. Remove the address — repeated sends to permanent failures are one of the main signals mailbox providers use to throttle a sender.
- How do I fix SMTP 550 5.7.23?
- Add every service that sends as your domain to the SPF record.
Other 550 replies
- 550 5.1.1 — mailbox does not exist
- 550 5.7.1 — message refused by policy
- 550 5.4.1 — recipient address rejected, access denied
- 550 5.2.1 — mailbox disabled, not accepting messages
- 550 — mailbox unavailable
- 550 5.1.0 — address rejected, other address status
- 550 5.1.10 — recipient not found (Microsoft 365)
- 550 5.1.8 — bad outbound sender (Microsoft 365)
- 550 5.4.5 — daily sending limit exceeded (Gmail)
- 550 4.4.7 — message expired in the queue
- 550 5.7.25 — no PTR record for sending IP (Gmail)
- 550 5.7.26 — blocked, sender unauthenticated (Gmail)
- 550 5.7.27 — SPF authentication failed (Gmail)
- 550 5.7.28 — unusual rate of unsolicited mail (Gmail)
- 550 5.7.124 — sender not in allowed senders list (Microsoft 365)
- 550 5.7.509 — DMARC failed, policy reject (Microsoft 365)
- 550 5.7.606-649 — banned sending IP (Microsoft)
- 550 5.7.705 — tenant has exceeded threshold (Microsoft 365)
- 550 5.7.708 — traffic not accepted from this IP (Microsoft 365)
- 550 5.7.750 — blocked from sending from unregistered domains (Microsoft 365)
- 550 5.7.515 — authentication required for high-volume senders (Outlook.com)
- 550 5.7.1 S3140 — IP range on Outlook.com block list
Last reviewed 2026-09-11