# Gmail 421 4.7.x "rate limited": what each code means and how to fix it A `421` from Gmail is a temporary rejection. Gmail isn't refusing the message for good: it's telling your server to slow down and try again later. Your server retries on its own, so the mail often arrives hours late instead of not at all. Left alone, the same problem tends to become a permanent `550` bounce. The number after `4.7.` tells you which check failed. ## What each code means | Code | Gmail's reason | What to fix | |---|---|---| | 421 4.7.26 | "This email has been rate limited because it is unauthenticated." | Neither SPF nor DKIM passed: fix both | | 421 4.7.27 | "Your email has been rate limited because SPF authentication didn't pass for this message." | SPF | | 421 4.7.30 | "Your email has been rate limited because DKIM authentication didn't pass for this message." | DKIM | | 421 4.7.32 | The From: header isn't aligned with the SPF or DKIM domain | DMARC alignment | | 421 4.7.40 | The sending domain has no DMARC record, or one Gmail can't use | Publish DMARC | | 421 4.7.29 | "Your email has been rate limited because you're not using a TLS connection." | Turn on TLS for outgoing mail | | 421 4.7.28 | "Gmail has detected an unusual rate of unsolicited email" from your IP, DKIM domain, SPF domain or a URL in the message | Reputation: volume, complaints, lists | | 421 4.7.0 | Several reasons: no PTR record for the sending IP, very low IP or domain reputation, TLS required, or "Try again later" | Read the full message | The codes from 4.7.26 to 4.7.40 are authentication problems you fix in DNS or in your sending service. 4.7.28 and most 4.7.0 messages are about reputation, and no DNS record fixes those on its own. ## Why you're seeing it now Since February 2024, Gmail has required every sender to have SPF or DKIM, and anyone sending close to 5,000 messages a day to personal Gmail accounts to have SPF, DKIM and DMARC as well. Google's FAQ says that starting November 2025, "Gmail is ramping up its enforcement on non-compliant traffic", with temporary and permanent rejections, rolled out gradually. Domains that used to get away with a missing record now see 421s. Once Gmail classifies you as a bulk sender, you stay one, even if your volume drops. ## Step 1: find the failing check in the headers Send a test from the affected system to a Gmail address you control. If it arrives, open it, choose **Show original** and look at the summary at the top: SPF, DKIM and DMARC each show PASS or FAIL, with the domain checked. If nothing arrives, the full text of the 421 is in your server's queue or logs (or the delay notice your mail service sends you). Gmail's message names the domain or IP it is complaining about. ## Step 2: fix the record ### 4.7.26 or 4.7.27: SPF 1. Find the sending IP and the service it belongs to. 2. Add that service to your SPF record using its own setup guide. 3. Keep to one SPF record, within the 10-lookup limit. See [SPF "too many DNS lookups"](/guides/spf-too-many-dns-lookups). ### 4.7.26 or 4.7.30: DKIM Turn on DKIM signing in the service and publish the record it gives you, signing with your own domain rather than the service's. See [set up DKIM](/guides/dkim-setup). ### 4.7.32: alignment SPF and DKIM can both pass and still not count, if they pass for the service's domain instead of yours. Set a custom Return-Path ("custom MAIL FROM" or "bounce domain") on your domain, and sign DKIM with your domain. DMARC needs at least one of the two to match the From domain. ### 4.7.40: no DMARC record Publish one. `p=none` meets Gmail's requirement: ``` _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com" ``` Then read the reports and move it towards enforcement: [DMARC from none to reject](/guides/dmarc-none-to-reject). ### 4.7.28 and reputation Authentication must pass first, but these are about how recipients react to your mail. Google asks bulk senders to keep the user-reported spam rate below 0.10% and never reach 0.30%, and to support one-click unsubscribe (the `List-Unsubscribe` and `List-Unsubscribe-Post` headers). Over 0.3%, Google won't help with delivery problems. Check your spam rate in Google Postmaster Tools, remove addresses that never engage, and slow new or bursty sends down. ## Step 3: confirm Send another test, check that SPF, DKIM and DMARC all show PASS, and watch your queue: the deferred messages are delivered on their next retry once Gmail accepts them. If Gmail has moved on to permanent bounces, see [Gmail 550 5.7.26](/guides/550-5-7-26). ## Check your domain The [free scan](/#scan) checks SPF, DKIM and DMARC for your domain. For single checks, use the [DMARC checker](/tools/dmarc-checker) and the [SPF lookup counter](/tools/spf-lookup-counter). ## Sources - [Google Workspace: Gmail SMTP errors and codes](https://knowledge.workspace.google.com/admin/support/troubleshooting/gmail-smtp-errors-and-codes) - [Google: Email sender guidelines](https://support.google.com/a/answer/81126) - [Google: Email sender guidelines FAQ](https://support.google.com/a/answer/14229414) - [RFC 7208: SPF](https://www.rfc-editor.org/rfc/rfc7208) - [RFC 9989: DMARC](https://www.rfc-editor.org/rfc/rfc9989) --- Source: https://nameward.app/guides/gmail-421-4-7-temporary-block (updated 2026-10-31)