550 5.7.23: Fix "Message Rejected Because of Sender Policy Framework Violation"
The short answer (what's causing it)
The recipient's server evaluated your SPF and got a hard fail — the sending IP isn't authorised by the envelope domain's SPF record, which ends in -all.
Step-by-step fix
- Find the sending IP in the bounce/headers.
- Identify the service and add its documented include (not raw IPs if they change).
- Watch the 10-lookup limit.
- Re-scan and resend.
Record examples (replace example.co.uk with your domain)
example.co.uk. TXT "v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net -all"
Examples are illustrative templates, not values for your domain. Test changes at
p=none/ staging first.
Check yours free in seconds
Run the free 20-check SuperTool on your domain: no signup, no install, public DNS only. Relevant checks: SPF.
Scan my domain free (20-check SuperTool) → £24 Sovereign DMARC (T0 RUA), SPF, MTA-STS & PHP2Shell Remediation Pack → £5 Website Launch Special Quick-Fix Pack →One-off download via PayPal guest checkout, no subscription. Packs contain DNS/config templates and scripts you run yourself.
Frequently Asked Questions
Is it the recipient's fault?
Usually no — their server is enforcing your published SPF.
Forwarded mail?
Forwarding breaks SPF; aligned DKIM is the resilient fix.
Related FaultyPacket guides & tools
Authorised use: only scan domains you own or are authorised to inspect. Results are point-in-time public DNS observations.