Short answer: The message was rejected because it came from a server that the sending domain's SPF record does not authorize. Microsoft 365 returns this with the text "Sender Policy Framework violation".
550 5.7.23 bounce message examples
The same code comes with different wording on different servers. In the bounce (non-delivery report) you may see one of these lines:
550 5.7.23 The message was rejected because of Sender Policy Framework violation (Microsoft 365) 550 5.7.23 SPF validation failed
Type: Permanent error. The sending server won't retry; fix the problem and send the message again.
What causes it?
| Cause | Explanation |
|---|---|
| Sending server not in SPF | A new host, CRM, invoicing system or newsletter tool was added but never included in the SPF record. |
SPF ends in -all | Unlisted sources get a hard fail; with ~all the message would more likely have gone to spam instead. |
| More than one SPF record | Two separate v=spf1 records on the domain produce a permerror, which counts as a failure. |
| 10 DNS lookup limit exceeded | Too many nested include mechanisms make SPF evaluation fail. |
| Forwarding | When an intermediate server forwards the message, the sending IP changes and SPF naturally breaks. |
What to do as the sender
- Check your SPF record: make sure there is exactly one and that it covers every service that sends for you.
- Add the missing service. The SPF record generator builds a ready-to-paste record.
- If you have many includes, remove unused ones and stay under the 10-lookup limit.
- Enable DKIM as well: DMARC passes if DKIM is valid and aligned, even when SPF breaks.
What the receiving side's admin should check
- If you run a forwarding system, enable SRS (Sender Rewriting Scheme), or rely on ARC on the receiving side.
- Make sure internal mail from your own domain doesn't loop out through external servers.
Good to know
We explain why SPF alone isn't enough, and how it works with DKIM and DMARC, in SPF, DKIM and DMARC explained. For the right record on your platform: Microsoft 365, Google Workspace, cPanel hosting.
Protect your inbox from spam, malware and phishing: point your MX record to Spambil and try it free for 7 days. No credit card required.
Frequently asked questions
My SPF record looks right but I still get this error. Why?
Check which server actually sent the message: a website contact form, an e-invoicing system, or a scanner/printer may send from a different IP. The first Received header in the bounced message shows the real source.
Should I use ~all or -all?
Use -all if you are sure every sending source is listed. If not, start with ~all, watch your DMARC reports, then switch to -all.