What 550 5.7.23 means
The message Microsoft attaches to this code is “The message was rejected because of Sender Policy Framework violation”, as written on its reference page. The first digit says how final it is: a 5xx reply is permanent for that message, so the sending server gives up and returns a bounce. The enhanced status 5.7.23 says what class of problem it is: authentication. The receiver could not authenticate the message: SPF, DKIM or DMARC failed or is missing. A DNS fix, not a reputation fix.
Why it happens
The receiving server checked who sent the message and could not make the answer add up. Either the sending service is not listed in the domain's SPF record, the DKIM signature is missing or does not verify, or the domain that passed authentication is not the domain in the From header, which is what alignment means. Nothing about volume or reputation changes this: the record is either right or it is not.
What to do first: SPF hard fail. Fix the SPF record (10-lookup limit!).
Why warming does not fix this
Warming builds sender reputation. 550 5.7.23 in this form is a authentication problem, and no amount of engagement history changes it. Fix the cause and the bounce stops; warming is for what comes after, when the mail is accepted and the question becomes which folder it lands in. See how warming works for that part.
How to fix it, in order
- Run the auth checker on the sending domain
- Publish or repair the failing record (SPF, DKIM or DMARC)
- Check alignment with a message's headers in the auth checker
Related codes
- 550 5.7.27 (Gmail): SPF authentication failed
- 550 5.7.30 (Gmail): DKIM authentication failed
- 550 5.7.40 (Gmail): no DMARC record or policy
- 421 4.7.32 (Gmail): From header not aligned
- 550 5.7.26 (Gmail): sender is unauthenticated
More on Microsoft 365
- Microsoft 365 emails going to junk: the trace in order: headers, Message Trace, quarantine, SNDS
- Microsoft bulk sender requirements: the 5 May 2025 authentication rules and the 550 5.7.515 rejection
- Microsoft 365 sending limits: the documented recipient and message rate limits
Questions about 550 5.7.23
What does 550 5.7.23 mean?
Microsoft returns 550 5.7.23 with the message "The message was rejected because of Sender Policy Framework violation": SPF violation. The receiver could not authenticate the message: SPF, DKIM or DMARC failed or is missing. A DNS fix, not a reputation fix.
Is 550 5.7.23 a hard bounce or a soft bounce?
A hard bounce for that message: the 550 reply is permanent, and the message is not retried. Whether the address should be removed depends on the cause: here the fix is on the sending side, not the list.
How do I fix 550 5.7.23?
SPF hard fail. Fix the SPF record (10-lookup limit!). Microsoft's own reference for the code is linked on this page.
Does email warmup fix 550 5.7.23?
No. 550 5.7.23 in this form is a authentication problem, and warming builds reputation, which is not what is failing here. Fix the cause and the bounce stops.