5.7.23 SMTP bounce: SPF validation failed
What 5.7.23 means
The receiver's SPF check returned fail for the sending IP and its policy rejects that. The sending IP is not authorized by the envelope sender's SPF record.
Message text
SPF validation failed
Common causes of 5.7.23
- Sending IP or service is missing from the SPF record
- SPF record ends in -all and your server is not listed
How to fix 5.7.23
- Run SPF checker on the sending domain and add the sending server or service to its SPF record.
- Keep the SPF record under the 10 DNS lookup limit (SPF checker shows the count).
Check your domain
Check the SPF record of your sending domainRuns in your browser; nothing is uploaded.
Have the full bounce message? Paste it into the bounce code lookup and it will match the code and the provider for you. Open the bounce code lookup.
How to read 5.7.23
The second part, 5.7.23, is an enhanced status code (RFC 3463 §2) written class.subject.detail. Class 5 is a Permanent failure (5xx): the command was rejected and the sender should not repeat it unchanged (RFC 5321 §4.2.1; RFC 3463 §2).. Subject 7 is security or policy: authentication, authorization or policy refused the message. The detail number refines the subject, and providers may define details of their own, which is why one code can read differently at Gmail, Microsoft and Yahoo.
Do not keep resending the same message: a permanent failure repeats until the cause is fixed. Correct the cause, then send a new message.
Official source: www.rfc-editor.org. Last verified 2026-10-20.
Related guides
- SPF syntax errors: every checker message explained
- How to create an SPF record (syntax and examples)
- SPF “too many DNS lookups”: why it happens and how to fix it
Related codes
- 5.7.23 Microsoft: SPF violation
- 5.7.0 SMTP: security status
- 5.7.1 SMTP: delivery not authorized
- 5.7.25 SMTP: reverse DNS failed
- 5.7.26 SMTP: authentication failed
- 5.7.27 SMTP: sender has null MX
FAQ
What does 5.7.23 mean?
The receiver's SPF check returned fail for the sending IP and its policy rejects that. The sending IP is not authorized by the envelope sender's SPF record. This is a permanent failure.
How do I fix 5.7.23?
Run SPF checker on the sending domain and add the sending server or service to its SPF record. Keep the SPF record under the 10 DNS lookup limit (SPF checker shows the count).
Is 5.7.23 permanent, and should I retry?
5.7.23 is a permanent failure, so retrying the same message will fail again. Fix the cause first, then send a new message.