550 5.7.23: SPF violation on outgoing mail
The destination checked SPF on mail sent from your Microsoft 365 organization and rejected it, which points to a problem in your SPF setup.
- Microsoft
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550 5.7.23
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
550 5.7.23 The message was rejected because of Sender Policy Framework violation
What it means
5.7.23 comes back when the recipient's system validates SPF and a message from your Microsoft 365 organization fails. Microsoft says it most likely means an SPF configuration issue in your organization: a record that misses some of your sending sources, such as on-premises servers relaying through Microsoft 365, or domains you send from without provisioning them in the tenant. A less obvious cause is the High Risk Delivery Pool: when Microsoft 365 classifies an outbound message as spam, it sends it through that pool, and those messages do not pass SPF checks.
Common causes
- Your domain's SPF record does not include all the servers that send for it.
- You relay mail through Microsoft 365 for domains not provisioned in the tenant.
- Microsoft 365 judged the message spam and sent it through the High Risk Delivery Pool, which fails SPF.
How to fix it
- 01Check your domain's SPF record with an SPF checker and fix missing includes or syntax errors.
- 02Provision in Microsoft 365 every domain you own and send from.
- 03Add your on-premises IP addresses to the SPF record of each domain you send for.
- 04Check whether the message was flagged as outbound spam, set up outbound spam notifications, and contact support if the detection was wrong.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Fix NDR error "550 5.7.23" in Exchange Onlinelearn.microsoft.com
- Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com
Related codes
- 550 5.7.367Forwarded mail rejected by the next hop.A message Microsoft 365 forwarded or relayed was refused by the next server, often a third-party gateway, because it left from Microsoft's relay pool.
- 550 5.7.23SPF check failed.The SPF check on the sending server's IP address gave a fail result for the sender's domain, and the receiving server's policy rejects such mail.
Further reading
All 111 Microsoft codesEvery code in the wikiPaste your own bounce