550 5.7.1: SPF check failed
The recipient’s Cisco Secure Email gateway checked SPF, found your server not authorised for the sender domain, and its policy rejects that result.
- Cisco Secure Email
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550 5.7.1
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
550 5.7.1 #5.7.1 SPF unauthorized mail is prohibited
What it means
Cisco Secure Email Gateway can verify SPF on the HELO name and on the MAIL FROM address, and an administrator chooses which results to reject. When a rejected result comes up, the gateway ends the session with this reply, which is Cisco’s default for every SPF result except a temporary error. The administrator can change the wording, so some companies show their own text. It is permanent. Cisco can also be set to pass on an explanation published by your domain, which then appears in later lines of the reply.
Common causes
- The sending server or service is not included in your domain’s SPF record.
- The HELO name your server uses has an SPF record that does not authorise it.
- Your SPF record is broken or exceeds the 10 DNS lookup limit.
How to fix it
- 01Look up the SPF record of the envelope sender domain, and of your HELO name if it has one.
- 02Add every sending server and service, staying within 10 DNS lookups.
- 03Send a test message and confirm SPF passes before resending.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
Related codes
- 550Mailbox unavailable.The receiving server permanently refused the message for this recipient: the mailbox does not exist, cannot be reached, or the server rejected the message by policy.
- 5.7.1Delivery not authorised.The receiving server refuses the message because this sender is not allowed to send to this recipient, as a result of filtering by host or by recipient.
- 451 4.4.3SPF could not be checked.The Cisco gateway could not complete an SPF check for your domain because of a temporary error, usually in DNS, and asked your server to retry.
5.7.1 at other providers
- 550 5.7.1Blocked by a domain policy.A rule set by the recipient's or the sender's Google Workspace admin blocks this message, so Gmail rejected it under that policy.
- 550 5.7.1Relay IP does not match the sending domain.Google's SMTP relay knows your IP, but the mail's sending domain is not one that IP is registered to relay for in your Workspace account.
- 550 5.7.1Blocked as likely spam.Gmail's filters judged this message likely to be spam and rejected it outright, instead of delivering it to the spam folder.
- 550 5.7.1IPv6 sender without PTR or authentication.Gmail rejected mail that arrived over IPv6 because the sending address lacks a matching PTR record, or the message failed authentication.
- 550 5.7.1Blocked for low IP reputation.Gmail permanently rejected the message because the IP it came from has a very low reputation with Gmail.
- 550 5.7.1Blocked for low domain reputation.Gmail permanently rejected the message because the domain it comes from has a very low reputation with Gmail.
Further reading
All 7 Cisco Secure Email codesEvery code in the wikiPaste your own bounce