550: SPF check failed
The recipient’s Barracuda gateway checked the SPF record of your sending domain, found your server not authorised, and rejected the message.
- Barracuda
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
550 Rejecting for Sender Policy Framework (SPF).
What it means
Barracuda gateways can enforce SPF, and this reply means the IP that delivered your message is not authorised by the SPF record of the sender domain the gateway checked. The rejection is permanent. Like any SPF failure, it is fixed on the sending side by publishing a record that covers every server and service that sends with the domain. If you recently added a sending tool, it is the first suspect. Receivers that enforce SPF elsewhere are likely to treat the same mail the same way.
Common causes
- A service you send through is missing from your SPF record.
- Your SPF record exceeds the 10 DNS lookup limit or has a syntax error.
- The message was forwarded through a server your record does not cover.
How to fix it
- 01Look up the SPF record of the domain in your envelope sender address.
- 02Add every sending server and service, keeping within 10 DNS lookups.
- 03Send a test message and confirm SPF passes.
- 04Resend the rejected message.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- SMTP Error Codes, Barracuda Email Security Gateway documentationdocumentation.campus.barracuda.com
Related codes
- 550Mailbox unavailable.The receiving server permanently refused the message for this recipient: the mailbox does not exist, cannot be reached, or the server rejected the message by policy.
- 550Rejected as spoofed.The recipient’s Barracuda gateway decided your message pretends to come from a sender it does not really come from, and refused it.
550 at other providers
- 550 [SC-001]Outlook.com policy block for content or reputation.Outlook.com rejected the mail for policy reasons tied to spam-like content or to the reputation of the sending IP or domain.
- 550 [SC-002]Outlook.com block for namespace mining.Outlook.com blocked the sending IP because it behaved like a namespace miner, checking whether addresses exist without sending mail.
- 550 [SC-003]Outlook.com block for an open proxy or relay.Outlook.com rejected the mail because the sending IP appears to be an open proxy or open relay.
- 550 [SC-004]Outlook.com block after complaints.Outlook.com placed a block on the sending IP because it received complaints about mail coming from it.
- 550 [DY-001]Outlook.com refuses dynamic IP addresses.Outlook.com rejected the mail because the sending IP is dynamic address space, which it generally does not accept mail from.
- 550 [DY-002]Outlook.com block for a likely compromised sender.Outlook.com rejected the mail because the sending server or computer appears to be compromised or infected.
Further reading
All 11 Barracuda codesEvery code in the wikiPaste your own bounce