SMTP error 5.7.23 SPF validation failed

What SMTP error 5.7.23 means

The receiving server looked up the SPF record for your domain, compared it against the IP address the message actually arrived from, got a fail, and refused delivery. It normally arrives as 550 5.7.23 and the sender has a bounce within seconds. Nine times in ten something that sends email has been added to the business — a CRM, an accounts package, a new mail host — and nobody added it to the record.

Security or policy status
Sent by The receiving mail server, or the filtering gateway sitting in front of it
Common

What SMTP error 5.7.23 SPF validation failed actually means

SPF authorises IP addresses, not people and not mailboxes. The check runs against the domain in the envelope sender, the Return-Path set at MAIL FROM, which is frequently not the address the recipient sees in the From line. That is why a message can look entirely legitimate on screen and still be refused. A fail rather than a softfail also tells you the record ends in -all and the receiver has taken it at its word. The registry allows this code only in the permanent form: no transient variant will clear on a retry, because the answer is identical on every attempt until the DNS record changes.

This status code is returned when a message completed an SPF check that produced a "fail" result, contrary to local policy requirements. Used in place of 5.7.1 as described in Section 8.4 of [RFC7208].
— RFC 7372 with RFC 7208

How 5.7.23 appears in a bounce

A server reporting this condition sends it alongside a three-digit reply code, and a bounce prints the two together. The registry lists 550 5.7.23 as the pairing for this status.

The leading 5 is the server's verdict rather than part of the code's identity: it marks this as a permanent failure, which means the sending server has given up and returned the message.

What causes SMTP error 5.7.23 on a business phone system

A sending service that was never added to the recordMailchimp, Xero, Sage, a website contact form, a helpdesk. Each needs an include or an ip4 mechanism. The service works for months while receivers are lenient, then one large recipient tightens up and the invoices stop arriving.
Forwarding between two mailboxesForwarding preserves the original envelope sender but changes the connecting IP, so SPF fails at the far end through no fault of anyone. An old company address auto-forwarding to a personal Gmail account is the classic version.
A mail host change where the records crossed overThe old include is removed on the morning of the cutover while queued mail is still leaving the old platform, or the new one is added a day late. Either way there is a window where legitimate mail hard fails.
Two SPF records published on the same domainA setup wizard adds a second TXT record starting v=spf1 rather than merging into the existing one. Some receivers report that as an error, others treat the evaluation as failed and reject with this code.
The ten DNS lookup limit being crossedRFC 7208 caps the number of lookup-consuming mechanisms at ten. Past that the correct result is a permanent error, and while careful receivers report 5.7.24 for that, plenty fold it into a plain fail and send this instead.

How to fix SMTP error 5.7.23

Get the refused IP address out of the bounceThe non-delivery report usually names the address that was rejected. Look it up and you will normally recognise the service at once, which turns a vague deliverability complaint into a single record edit.
Write down everything that sends as your domainMail platform, accounts software, CRM, e-commerce, marketing, monitoring, the website, the printers. Most businesses find two or three they had forgotten, and you cannot write a correct record from a list nobody has made.
Publish exactly one record and count the lookupsOne TXT record per domain, starting v=spf1 and ending in a single all mechanism. Run it through a checker that resolves nested includes and confirm the total sits comfortably under ten, not exactly at ten.
Deal with forwarding rather than authorising around itAdding a forwarding host to your record authorises everything on that host. Convert old forwarders into real mailboxes or aliases inside your tenant, which keeps the mail inside one platform and removes the failure entirely.
Hold at ~all only while you auditA softfail buys time to find the stragglers and means nothing is enforced meanwhile. Set a date, work the list, then move to -all. A record that has sat on ~all for three years is a record nobody finished.

Fixing the underlying problem

This page explains the code. These guides walk through the fix in detail.

Questions about SMTP error 5.7.23

We passed SPF last week and fail this week, and nobody touched DNS. How?

Someone else touched theirs. A provider you include can add sending ranges or restructure their own record, and if that pushes the resolved lookup count past ten, or moves your traffic onto an address the record no longer covers, you fail without changing anything.

Does SPF check the address our customers actually see?

No, and this catches people out constantly. SPF validates the envelope sender, while the From line displayed in the mail client is a separate header SPF never looks at. That gap is why DMARC exists, and why a message can pass SPF and still be rejected as unauthenticated.

Should we just add our office IP address so the printers work?

It will stop the bounces and it is the wrong fix. You are authorising every device on that connection to send as your domain, including anything compromised. Point the printers at authenticated submission on your mail platform instead.

Related SMTP status codes

Source. SMTP error 5.7.23 SPF validation failed is defined in RFC 7372 with RFC 7208 and registered in the IANA SMTP Enhanced Status Codes registry. The causes and fixes above are drawn from our own experience supporting UK business email systems.

All Email delivery & SMTP codes