550 SPF Sender Invalid - envelope rejectedWhat does 550 SPF Sender Invalid envelope rejected mean?
The receiving server checked your SPF record and determined that your sending IP is not authorized to send mail on behalf of your domain. SPF (Sender Policy Framework) is a DNS record that lists which IP addresses and mail servers are permitted to send email for your domain. When your sending IP is not listed and the SPF policy uses -all (hard fail), the receiving server rejects the message with a 550.
Is this a soft or hard bounce?
Authentication failure, not a recipient issue. The recipient address is valid. Fix your SPF record to include your sending IP and retry. Do not suppress the recipient address.
Common causes
Sending IP not listed in SPF: You added a new sending server, ESP, or IP but did not update your SPF record to include it. Every IP you send from must be authorized in your SPF record.
SPF record uses -all: The hard fail qualifier -all at the end of your SPF record instructs receiving servers to reject any mail from unlisted IPs. If you changed sending infrastructure without updating SPF, this will cause immediate rejections.
Too many DNS lookups: SPF records are limited to 10 DNS lookups. Exceeding this limit causes a PermError which some servers treat as a fail, triggering this error.
Sending through a third-party ESP without adding their SPF include: If you use a service like SendGrid, Mailchimp, or Brevo, you must add their SPF include statement to your DNS record. Missing this causes SPF failures for all mail sent through that service.
How to fix it
Step 1: Check your current SPF record. Use our free SPF record checker to see what your SPF record currently authorizes.
Step 2: Add your sending IP or ESP include. Add the IP or include: mechanism for every service you send through. For example: include:sendgrid.net for SendGrid.
Step 3: Stay within the 10 DNS lookup limit. Use our SPF record generator to build a valid record that stays within limits.
Step 4: Verify with alignment. Ensure your SPF, DKIM, and DMARC are all aligned to prevent future authentication failures.
Provider-specific notes
| Provider | Behavior |
|---|---|
| Gmail | Checks SPF on all inbound mail. Returns 550 5.7.26 for SPF failures when DMARC is also failing. Strict enforcement since 2024 bulk sender requirements. |
| Outlook | Returns 550 5.7.1 or 550 SPF Sender Invalid for hard SPF fails. Also checks DKIM and DMARC alignment. |
| Postfix with SPF policy | Behavior depends on Postfix SPF policy daemon configuration. Can return 550 or 451 depending on policy action setting. |
Related error codes
550 Anti-Spoofing policy: Inbound not allowed · 451 Grey bounce SPF failure or not defined · 550 5.7.1 Service unavailable blocked using zen.spamhaus.org · 554 5.7.1 Access denied
About the Author
Alaa · LinkedIn
Email infrastructure specialist with 8+ years of hands-on experience in SMTP, deliverability, and email verification. I’ve configured and troubleshot mail systems across Postfix, Exchange, and cloud relays, managed IP reputation and warmup campaigns, and built verification pipelines processing millions of addresses. My work spans DNS authentication (SPF, DKIM, DMARC, BIMI), bounce handling, blocklist monitoring, and compliance frameworks including CAN-SPAM and GDPR. I write every article on SMTPedia to give email professionals, developers, and marketers the accurate, RFC-grounded reference they need.
About SMTPedia
SMTPedia is an independent email industry reference covering SMTP, IMAP, POP3, email deliverability, marketing platforms, DNS authentication, and email verification. Every article is researched from official provider documentation, IETF RFCs, and industry best practices. Settings and configurations are verified quarterly.
We are cited as a source by ChatGPT, Microsoft Copilot, and thousands of email professionals worldwide. Learn more about our editorial process.
