Outlook / Exchange Online SPF rejection

Fix Outlook 550 5.7.23 SPF violation

Microsoft documents 5.7.23 as a rejection caused by an SPF violation. The useful investigation starts with the message's sender IP and RFC 5321 MAIL FROM domain—not with a generic SPF record copied to the visible From domain.

Problem description

The NDR contains a response similar to:

550 5.7.23 The message was rejected because of Sender Policy Framework violation.

Check the current SPF record

What MailFixIt can test: the current public SPF policy, its supported DNS dependencies and an explicit sender IP/MAIL FROM path. It cannot reproduce the destination system's historical DNS cache, connector policy or receiver decision.

Is this temporary or permanent?

A 550 response is permanent for the rejected delivery. Correct the sender path before sending a new message; repeatedly retrying the same queued copy is not the resolution.

What Microsoft 5.7.23 means

The destination system used SPF to validate inbound mail and found a problem affecting the sender's SPF configuration. This can be a direct IP authorization failure, an invalid policy, a broken dependency or a mismatch between the domain being inspected and the envelope identity Microsoft evaluated.

Probable causes

The sending IP is not authorized by the SPF policy selected for the Return-Path domain.
The sending service recently changed IPs or requires an account-specific include that is absent.
The envelope domain is a subdomain with no SPF record; it does not inherit the parent policy.
Multiple SPF records or invalid syntax prevent deterministic evaluation.
A reachable include/redirect dependency is missing, cyclic or temporarily unavailable.
A third-party service uses its own bounce domain and needs custom MAIL FROM configuration.

How to diagnose the SPF violation

Open the NDR or headers and record the sending IP and Return-Path/MAIL FROM domain.
Query TXT at that exact domain and identify the one selected v=spf1 record.
Evaluate the supplied IP through reachable mechanisms in order; do not count terms after a terminating match.
Confirm every authorized service with its owner before consolidating or removing terms.
Separate a current DNS defect from a temporary lookup result or a receiver-specific connector policy.

How to fix Outlook 5.7.23

If the IP is a legitimate sender, add only the provider-supported authorization to the selected SPF policy at the real envelope domain. If it is not legitimate, correct the application's relay/sender configuration instead of authorizing it. Consolidate duplicate SPF records safely and preserve unrelated TXT records.

After the change propagates, send through the same service and inspect the new receiver headers. SPF success does not by itself prove DKIM, DMARC alignment, reputation or acceptance.

Frequently asked questions

What does Outlook 550 5.7.23 mean?

Microsoft says the destination email system rejected the message because of an SPF violation affecting the sender's SPF configuration.

Which domain should I check for SPF?

Check the RFC 5321 MAIL FROM or Return-Path domain used by the rejected message, not automatically the visible From domain.

Does an SPF record prove the sender passed SPF?

No. The actual sending IP must be authorized by the selected SPF policy for the message's envelope domain.

Related email diagnostics

Primary sources: Microsoft Exchange Online NDR reference and RFC 7208 SPF.