550 5.7.23: SPF check failed
The SPF check on the sending server's IP address gave a fail result for the sender's domain, and the receiving server's policy rejects such mail.
- Standard
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550 5.7.23
- Provider
- Standard SMTP codes
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
550 5.7.23 SPF validation failed
What it means
SPF lets a domain list the servers allowed to send its mail. When a receiver checks the envelope sender's domain (or the HELO name) and the connecting IP matches a mechanism marked with a minus, usually the closing -all, the result is fail. RFC 7208 says a receiver that rejects for this should use 550 5.7.1; RFC 7372 registered X.7.23 so the bounce can say exactly this, with reply 550. It is permanent, so the message is returned. The fix is in the SPF record: add the service that sent the message, or send through a server that is already listed.
Common causes
- A new email service sends for your domain but is not included in your SPF record.
- The SPF record lists the wrong IP addresses or include domains.
- Mail forwarded by a server that is not in your SPF record.
- A spoofed message using your domain, correctly rejected.
How to fix it
- 01Look up your domain's SPF record and check that it covers every service that sends as you.
- 02Add the missing include: or ip4:/ip6: mechanism, keeping a single SPF record within 10 DNS lookups.
- 03Check which domain was tested: it is the envelope sender (Return-Path), which may differ from the From address.
- 04Resend once the updated record is visible in DNS.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- RFC 7372, section 3.2: SPF Failure Codesrfc-editor.org
- RFC 7208, section 8.4: Fail (SPF)rfc-editor.org
- RFC 7208, section 4.6.4: DNS Lookup Limits (SPF)rfc-editor.org
- IANA, SMTP Enhanced Status Codes registry (Enumerated Status Codes)iana.org
Related codes
- 5.7.24SPF check error.The receiving server could not complete the SPF check for the sender's domain, either because of a temporary DNS problem or because the SPF record is broken.
- 5.7.1Delivery not authorised.The receiving server refuses the message because this sender is not allowed to send to this recipient, as a result of filtering by host or by recipient.
- 550 5.7.26Multiple authentication checks failed.The message failed more than one authentication check, for example SPF and DKIM, and the receiving server's policy rejects it.
- 550Mailbox unavailable.The receiving server permanently refused the message for this recipient: the mailbox does not exist, cannot be reached, or the server rejected the message by policy.
5.7.23 at other providers
Further reading
All 105 standard codesEvery code in the wikiPaste your own bounce