Most common causes
- The actual sending IP is not authorized by the envelope domain’s SPF record
- An include or redirect dependency no longer resolves as expected
- The SPF policy exceeds evaluation limits or returns an error
- The application is using a different envelope-sender domain than the one being reviewed
What to verify next
- Run the SPF Dependency Graph for the envelope-sender domain
- Identify the actual outbound IP from SMTP or header evidence
- Check recursive includes, void lookups and duplicate SPF records
- Retest the exact sending path after correcting authorization
Best diagnostic path
Live analysis
Mail Failure Doctor
Classify the complete rejection and preserve provider-specific diagnostic context.
Open analysis → Live analysisSPF Dependency Graph
Resolve recursive authorization paths, lookup pressure and the effective sender policy.
Open analysis → Live analysisEmail Infrastructure Digital Twin
Map the domain’s public mail infrastructure and provider relationships before remediation.
Open analysis →Why the exact message matters
The same status family can be triggered by different conditions, and providers frequently add diagnostic text that narrows the issue. Use the complete rejection text rather than treating the numeric code as a complete diagnosis.
Provider reference
For the provider-defined meaning and current requirements, review Microsoft Exchange Online NDR reference.