550: SPF check failed
Mimecast rejected the message because the IP that sent it is not listed in the SPF record of the sender’s domain, and the recipient’s policy rejects SPF failures.
- Mimecast
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550
- Provider
- Mimecast
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
550 SPF Sender Invalid - envelope rejected.
What it means
Mimecast checks inbound mail against the SPF record of the envelope sender’s domain. When the sending IP is not among those the record authorises, and the recipient company’s DNS Authentication policy is set to reject on failure, the message is refused permanently with this reply. Mimecast notes that a customer can switch that option off, in which case failing messages go through spam and blocklist checks instead. The fault itself is on the sending side: an SPF record that misses a server or service you send through will cause trouble with other receivers that enforce SPF as well.
Common causes
- You send through a service, such as a sales engagement tool or a newsletter platform, that your SPF record does not include.
- Your SPF record exceeds the 10 DNS lookup limit, so receivers cannot evaluate it.
- Mail was forwarded through a server that is not in your SPF record.
How to fix it
- 01Look up the SPF record of the envelope sender domain shown in the bounce.
- 02Add every server and service that sends with that domain, keeping within 10 DNS lookups.
- 03Send a test to an address that shows authentication results and confirm SPF passes.
- 04Resend the rejected message, since Mimecast did not keep it.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Policies - Mimecast SMTP Error Codes (Mimecast support)mimecastsupport.zendesk.com
Related codes
- 550Mailbox unavailable.The receiving server permanently refused the message for this recipient: the mailbox does not exist, cannot be reached, or the server rejected the message by policy.
- 550Blocked by a sender policy or a failed SPF check.The recipient company’s Mimecast account refused your sender address or domain, either through a Blocked Senders policy or because the message hard-failed SPF.
- 550DMARC check failed.Mimecast rejected the message on DMARC grounds: the authentication it found did not satisfy the DMARC policy of your From domain.
550 at other providers
- 550 [SC-001]Outlook.com policy block for content or reputation.Outlook.com rejected the mail for policy reasons tied to spam-like content or to the reputation of the sending IP or domain.
- 550 [SC-002]Outlook.com block for namespace mining.Outlook.com blocked the sending IP because it behaved like a namespace miner, checking whether addresses exist without sending mail.
- 550 [SC-003]Outlook.com block for an open proxy or relay.Outlook.com rejected the mail because the sending IP appears to be an open proxy or open relay.
- 550 [SC-004]Outlook.com block after complaints.Outlook.com placed a block on the sending IP because it received complaints about mail coming from it.
- 550 [DY-001]Outlook.com refuses dynamic IP addresses.Outlook.com rejected the mail because the sending IP is dynamic address space, which it generally does not accept mail from.
- 550 [DY-002]Outlook.com block for a likely compromised sender.Outlook.com rejected the mail because the sending server or computer appears to be compromised or infected.
Further reading
All 19 Mimecast codesEvery code in the wikiPaste your own bounce