Is 550 5.7.23 permanent or temporary?

550 5.7.23 is a permanent (5.x.x) failure — the server will not accept the message as-is, and retrying without changing anything won't help. You need to fix the underlying cause.

Is this my problem or the recipient's?

It depends on the cause — microsoft 365 is not in your spf record is the most common. Work through the causes below to find which applies to you.

How do I check my sending setup?

Run a free EmailHealth check on your domain — it verifies SPF, DKIM, DMARC, blacklist status, and more in a couple of seconds, which covers the most common causes of delivery failures.

550 5.7.23 — Message rejected for an SPF violation (Exchange Online)

Message rejected for an SPF violation (Exchange Online)

A 550 5.7.23 says "The message was rejected because of Sender Policy Framework violation." The receiving system checked SPF for your domain and the sending IP was not allowed.

Updated June 13, 2026

SMTP Exchange / Mail Log

> MAIL FROM:<you@yourdomain.com>> RCPT TO:<recipient@example.com>✕ 550 5.7.23 Message rejected for an SPF violation (Exchange Online)

550 5.7.23 is a permanent SMTP reply meaning message rejected for an spf violation (exchange online). Microsoft explains that the destination email system uses SPF to validate inbound mail, and there is a problem with your SPF configuration.

What 550 5.7.23 means

Microsoft explains that the destination email system uses SPF to validate inbound mail, and there is a problem with your SPF configuration.

⚠️

This is a 5.x.x permanent failure — the message will keep bouncing until you fix the cause. Retrying the same message unchanged won't help.

Common causes

📨

Microsoft 365 is not in your SPF record

Most common

The record is missing include:spf.protection.outlook.com, or it was removed during an edit.

🔁

The record ends in -all and a real sender is missing

Common

A hard fail makes the receiver reject mail from any service you forgot to list.

⚙️

SPF is invalid

Common

Two SPF records, a syntax error, or more than 10 lookups make SPF fail.

How to fix 550 5.7.23

1
List every service that sends for you
Include Microsoft 365, your ESPs and your servers in one SPF record.
2
Stay under 10 DNS lookups
Remove includes you no longer use, or flatten SPF if you need many services.
3
Check SPF
Run the free SPF checker to see the record, the lookup count, and any error.

Confirm your domain is set up correctly

Most delivery failures — permanent or temporary — trace back to authentication or reputation. Run a free EmailHealth check to confirm SPF, DKIM, DMARC, blacklist status, and TLS are all healthy for your sending domain. If you send in volume, free daily monitoring will alert you before a small issue becomes a flood of bounces.