SPF Validation Error

This is absolutely a widespread issue on Microsoft's end. We are seeing this with multiple businesses. In every example the message headers include spf=pass, dmarc=pass, dkim=pass.

Its a wider issue. See https://www.reddit.com/r/sysadmin/comments/1xog37a/spf_failures_hotmail/

Domains with valid SPF, DMARC and DKIM are being rejected. It only happens for a small percentage of the emails (probably depends on which Microsoft server your message gets routed to).

I strongly suspect this is a Microsoft issue. We have only come across this when sending to hotmail accounts. We first had rejections yesterday, resending the email was sometimes successful. Today I have had an email which was sent to 2 recipients, no issue with the Gmail recipient but the hotmail recipient was bounced!

If there is an issue with our SPF record as the "solution" suggests, why would emails be accepted by Gmail, and why would emails be sometimes bounced by hotmail and other time go through?

I work in IT.
We have 4 different businesses facing the same issue. Happens to random users, not the whole business as same time Im suspecting a new Microsoft issue that they dont know about yet.

Out of interest, what email filter do you use, if any?

Hi @W ,

I understand how frustrating this must be.

Firstly, I would like to clarify that this is a public forum, so please avoid posting the entire email, message content, or any personal information. To prevent the post from being automatically blocked, please share only the relevant error details first.

The 550 5.7.23 error typically indicates that the sending IP address is not authorized by the domain's SPF record or that SPF validation failed during message authentication.

If you're encounter this error, the steps below may help:

Please note that these changes must be performed by the email or domain administrator, as they typically require access to DNS records and mail server configuration. If you're not the administrator and don't know who the admin is in your organization, you can find guidance here: How can I find my Microsoft 365 admin? - Microsoft Support    

1. Verify that the sending domain has a valid SPF record published in DNS.
2. Confirm that the IP address or mail service actually sending the messages is included in the SPF record. This includes any on-premises mail servers, SMTP relays, bulk mail providers, CRM systems, or third-party email gateways.
3. Ensure that only one SPF record exists for the domain, as multiple SPF records can cause SPF validation failures.
4. Check that the SPF record does not exceed the SPF limit of 10 DNS lookups.
5. If messages are routed through a third-party gateway or filtering service, verify that SPF evaluation is being performed against the correct originating sender and that the gateway is configured appropriately.
6. If applicable, verify that DKIM and DMARC are also configured correctly, as mail authentication issues can sometimes involve multiple authentication methods.
7. After making any DNS changes, allow time for DNS propagation and then retest message delivery

If the issue persists after the above checks, please contact Microsoft Support for further investigation, as additional backend analysis may be required. Their specialists can perform deeper diagnostics and, if needed, escalate the case to the appropriate internal team for further analysis. This ensures the issue is formally tracked and may contribute to a future fix.   

For business support:   

• Submit a service request: The administrator should create a support request with Microsoft to receive advanced technical assistance. For detailed instructions, see: Get support - Microsoft 365 admin | Microsoft Learn    
• If your subscription is from a partner or reseller, contact the reseller's support provider to help open a service request on behalf of you instead.

If you discover any solutions or have additional insights, please consider replying to this thread to help others in the community.   

I sincerely apologize for redirecting you to the Microsoft Technical Support Team. While I strive to assist as much as possible here in the forum, my resources are limited when it comes to backend-level diagnostics and advanced troubleshooting. Some issues require deeper technical analysis and access to internal tools that only the official support team can provide.    

For your reference: Fix NDR error 5.7.23 in Exchange Online - Exchange | Microsoft Learn 

If you need further assistance, feel free to reply. I'm here and happy to help!