A 421 from Gmail is a temporary rejection. Gmail isn't refusing the
message for good: it's telling your server to slow down and try again later.
Your server retries on its own, so the mail often arrives hours late instead
of not at all. Left alone, the same problem tends to become a permanent
550 bounce.
The number after 4.7. tells you which check failed.
What each code means
| Code | Gmail's reason | What to fix |
|---|---|---|
| 421 4.7.26 | "This email has been rate limited because it is unauthenticated." | Neither SPF nor DKIM passed: fix both |
| 421 4.7.27 | "Your email has been rate limited because SPF authentication didn't pass for this message." | SPF |
| 421 4.7.30 | "Your email has been rate limited because DKIM authentication didn't pass for this message." | DKIM |
| 421 4.7.32 | The From: header isn't aligned with the SPF or DKIM domain | DMARC alignment |
| 421 4.7.40 | The sending domain has no DMARC record, or one Gmail can't use | Publish DMARC |
| 421 4.7.29 | "Your email has been rate limited because you're not using a TLS connection." | Turn on TLS for outgoing mail |
| 421 4.7.28 | "Gmail has detected an unusual rate of unsolicited email" from your IP, DKIM domain, SPF domain or a URL in the message | Reputation: volume, complaints, lists |
| 421 4.7.0 | Several reasons: no PTR record for the sending IP, very low IP or domain reputation, TLS required, or "Try again later" | Read the full message |
The codes from 4.7.26 to 4.7.40 are authentication problems you fix in DNS or in your sending service. 4.7.28 and most 4.7.0 messages are about reputation, and no DNS record fixes those on its own.
Why you're seeing it now
Since February 2024, Gmail has required every sender to have SPF or DKIM, and anyone sending close to 5,000 messages a day to personal Gmail accounts to have SPF, DKIM and DMARC as well. Google's FAQ says that starting November 2025, "Gmail is ramping up its enforcement on non-compliant traffic", with temporary and permanent rejections, rolled out gradually. Domains that used to get away with a missing record now see 421s.
Once Gmail classifies you as a bulk sender, you stay one, even if your volume drops.
Step 1: find the failing check in the headers
Send a test from the affected system to a Gmail address you control. If it arrives, open it, choose Show original and look at the summary at the top: SPF, DKIM and DMARC each show PASS or FAIL, with the domain checked.
If nothing arrives, the full text of the 421 is in your server's queue or logs (or the delay notice your mail service sends you). Gmail's message names the domain or IP it is complaining about.
Step 2: fix the record
4.7.26 or 4.7.27: SPF
- Find the sending IP and the service it belongs to.
- Add that service to your SPF record using its own setup guide.
- Keep to one SPF record, within the 10-lookup limit. See SPF "too many DNS lookups".
4.7.26 or 4.7.30: DKIM
Turn on DKIM signing in the service and publish the record it gives you, signing with your own domain rather than the service's. See set up DKIM.
4.7.32: alignment
SPF and DKIM can both pass and still not count, if they pass for the service's domain instead of yours. Set a custom Return-Path ("custom MAIL FROM" or "bounce domain") on your domain, and sign DKIM with your domain. DMARC needs at least one of the two to match the From domain.
4.7.40: no DMARC record
Publish one. p=none meets Gmail's requirement:
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
Then read the reports and move it towards enforcement: DMARC from none to reject.
4.7.28 and reputation
Authentication must pass first, but these are about how recipients react to
your mail. Google asks bulk senders to keep the user-reported spam rate
below 0.10% and never reach 0.30%, and to support one-click unsubscribe
(the List-Unsubscribe and List-Unsubscribe-Post headers). Over 0.3%,
Google won't help with delivery problems. Check your spam rate in Google
Postmaster Tools, remove addresses that never engage, and slow new or
bursty sends down.
Step 3: confirm
Send another test, check that SPF, DKIM and DMARC all show PASS, and watch your queue: the deferred messages are delivered on their next retry once Gmail accepts them. If Gmail has moved on to permanent bounces, see Gmail 550 5.7.26.
Check your domain
The free scan checks SPF, DKIM and DMARC for your domain. For single checks, use the DMARC checker and the SPF lookup counter.