Using New Outlook on Windows for professional communication and productivity
A Microsoft 365 email administrator must resolve 550 5.7.23; changing settings or reinstalling New Outlook will not correct this server-side delivery failure. ^1^
If you are not the administrator
Send your administrator:
- The complete non-delivery report (NDR), including Diagnostic information for administrators.
- The sender and recipient addresses, message time, and message subject.
- This error-specific Microsoft guidance:
550 5.7.23generally means the sending domain’s SPF record is missing or misconfigured. ^2^
No Outlook client change is indicated by this code.
Administrator remediation
- Inspect the original error in the NDR In Diagnostic information for administrators, identify the sending domain and the original rejection returned when Exchange Online attempted delivery.
- Confirm that the sending domain is provisioned Go to Microsoft 365 admin center → Settings → Domains. Confirm that the domain used by the sender is listed and healthy. Microsoft limits mail sent from unprovisioned domains. ^1^
- Check the domain’s SPF TXT record Query the public DNS record with an SPF/DNS checker. There must be only one SPF record for each domain or subdomain, and it must authorize every system that legitimately sends mail for that domain. SPF records are changed at the DNS hosting provider or domain registrar, not in a Microsoft 365 admin portal. ^3^ If standard commercial Microsoft 365 is the only sender, the documented value is:
Do not replace an existing SPF record with that value if mail also originates from an on-premises server, bulk-mail platform, CRM, or another service. Add all legitimate sources to the single SPF record. Each sending subdomain needs its own record. GCC High, DoD, and Microsoft 365 operated by 21Vianet use different documentedv=spf1 include:spf.protection.outlook.com -allincludevalues; do not use the commercial value for those environments. ^3^ - Include applicable on-premises senders If an on-premises mail system relays messages using this domain, add its public sending IP address or range to SPF. Also review any unprovisioned domains relayed through Microsoft 365. ^1^
- Check whether the message used the high-risk delivery pool Run Message trace in the Exchange admin center and inspect
OutboundIpPoolNamein the trace output. Messages classified as spam can be routed through the high-risk delivery pool; these messages do not pass SPF at the destination, and delivery is not guaranteed. ^4^ - Retest after DNS propagation Allow the DNS record’s configured TTL to expire, then send a new, plain message to the Hotmail recipient. Do not merely resend the original NDR item.
Escalation
If SPF is valid, the domain is provisioned, and message trace shows that the message was incorrectly classified as spam, open a Microsoft 365 support request. Microsoft specifically recommends contacting support for an incorrect outbound-spam determination. ^1^
References