550 5.7.23 error: Rejected because SPF failed
The receiving server checked SPF and the sending IP isn't authorised in the domain's SPF record (or the record is broken), so it refused the message.
How to fix 550 5.7.23
- Add the sending service or IP to the SPF record, keeping the total under 10 DNS lookups.
- Make sure there is only one SPF record on the domain.
Why this happens
The receiver checks SPF, DKIM and DMARC and expects the domain in the visible From address to line up with at least one of them. A missing record, a sending tool nobody added to SPF, or a signature for the wrong domain all fail this check.
How to keep it from coming back
Publish SPF, enable DKIM signing for your own domain on every tool that sends as it, and add a DMARC record. Check alignment on a real message after every change to your sending setup.
Should I retry a 550 5.7.23 error?
Not as it stands. A permanent error means the same message will be refused again until the cause is fixed on your side. Fix the cause first, then send a fresh message; if it keeps failing after that, check the full text of the bounce for the exact reason.
Got the full bounce message?
The text after the code names the exact reason, and the same code can mean different things at different receivers. Paste the whole message into the decoder - it runs in your browser and nothing is sent.
Open the bounce decoderRelated error codes
Seeing this again and again? That's usually a reputation or authentication problem we can trace and fix at the source.
How we help: Consulting · Private infrastructure · Managed mailboxes · Monthly support