Microsoft 5.7.23: SPF violation
By Jose Pollman · Published
Microsoft checked your SPF record and the IP that sent the message was not authorised by it, so your mail is not proving it came from you. Add the sending service to your SPF record, then confirm the record is under the ten-lookup limit — one that exceeds it fails exactly like a missing record.
The error
550 5.7.23 The message was rejected because of Sender Policy Framework violationWhat it means
The receiving Microsoft system checked your SPF record and the sending IP was not authorised by it.
Your mail is not proving it came from you. SPF, DKIM or DMARC is missing or failing.
Why it happens
Either the IP genuinely is not in your record, or your record is broken in a way that makes evaluation fail — most often more than ten DNS lookups, which makes the whole record a permanent error regardless of what it lists.
How to fix it
- Check the sending IP against your SPF record.
- Count your DNS lookups. Over ten and the record fails entirely, no matter how correct the rest of it looks.
- Add the missing sender, or flatten the record if you are at the lookup limit.
- Note that SPF breaks on forwarding — if this only happens for forwarded mail, DKIM is the fix, not SPF.
Official documentation: Microsoft: fix error code 5.7.23.
Related guides
- Microsoft 5.4.1: relay access denied — Microsoft returns 5.4.1 for two different situations: the recipient address does not exist in the destination tenant, or the receiving system does not accept mail for that domain at all.
- Microsoft 5.7.606: banned sending IP — Microsoft has blocklisted the IP you are sending from. The codes 5.7.606 through 5.7.649 all mean the same thing; the varying number identifies which internal list caught it.
- TLS and DANE validation bounces — Microsoft would not deliver because the destination’s TLS setup failed validation — no STARTTLS, an expired certificate, a hostname mismatch, or a failing DANE or DNSSEC record.