The sending IP is not authorized by the SPF record of the envelope sender domain, and the receiver refused the message.
Policy rejection · fixable
Common causes
- The service or server you send from is not in your SPF record
- Your SPF record ends in -all and a forwarder relayed the message
- Two SPF records exist, which makes SPF invalid
How to fix it
- Use the SPF Checker with your sending IP to see what is missing
- Add the right include: or ip4: mechanism and keep a single SPF record
- Stay under the 10 DNS lookup limit
SPF CheckerRun the right check for your domain or paste the full bounce message for a precise explanation.
Open SPF Checker →Frequently asked questions
What is the difference between 5.7.23 and 5.7.26?
5.7.23 is specifically an SPF failure. 5.7.26 means several authentication checks failed (typically DMARC). A broken SPF record (PermError, e.g. more than 10 lookups) is reported as 5.7.24 "SPF validation error".