Skip to content
Webmaster Tools
EmailEmail Deliverability421 4.7.28

421 4.7.28 rate limited for unusual mail

What the 421 4.7.28 deferral means, why Gmail rate limits an IP or domain that sends unusual amounts of mail, and how to recover your sending reputation.

What 421 4.7.28 means

A 421 4.7.28 reply means the receiving server is temporarily refusing your mail because it sees an unusual rate of unwanted messages from your IP address or domain. The basic code 421 means the service is not available right now and the connection is closing. In the enhanced status code (RFC 3463), class 4 is a temporary failure and subject 7 is security or policy. Your server keeps the message in its queue and retries.

Gmail is the main source of this code. Its deferrals typically read like this:

421-4.7.28 Gmail has detected an unusual rate of unsolicited mail originating
421-4.7.28 from your IP address. To protect our users from spam, mail sent from
421-4.7.28 your IP address has been temporarily rate limited.

Variants name your DKIM domain or the sending domain instead of the IP, which tells you whose reputation is the problem. The exact text changes over time, so read the full reply in your mail log.

Why it happens

Gmail rate limits based on reputation and recent behaviour, not a fixed number. Typical triggers:

  • A sudden jump in volume: a big campaign from a new or quiet IP or domain, without warming it up.
  • High spam complaints: recipients marking your mail as spam. Gmail asks bulk senders to stay below a 0.3% spam rate.
  • Mailing old or bought lists, with many invalid addresses and spam traps.
  • A compromised account or form sending spam through your server.
  • Shared IPs: on a shared pool of an email service, another customer's mail can affect the IP's reputation.
  • Weak authentication: mail that passes SPF and DKIM with aligned DMARC is judged on your domain's reputation rather than only the IP's.

How to fix it

  1. Let the queue retry. 4xx means temporary. Don't resend manually or loop retries quickly; that adds to the volume. Postfix retries by itself; you can check the queue:
postqueue -p | grep -c gmail.com
postconf maximal_queue_lifetime   # default 5d
  1. Slow down to Gmail. In Postfix, a dedicated transport with low concurrency and a delay between messages keeps you under the limit while reputation recovers:
# /etc/postfix/transport
gmail.com       slow:
googlemail.com  slow:

# /etc/postfix/main.cf
transport_maps = hash:/etc/postfix/transport
slow_destination_concurrency_limit = 2
slow_destination_rate_delay = 1s

Add a slow line to master.cf copied from the smtp service, then run postmap /etc/postfix/transport and postfix reload.

  1. Find the cause. Look for spikes in your logs, check for compromised accounts, and stop mailing anyone who has not engaged in months.
  2. Watch your spam rate in Google Postmaster Tools if you send in volume, and make unsubscribing easy (one-click List-Unsubscribe).
  3. Authenticate fully: SPF, DKIM with your own domain, and DMARC. See the Gmail and Yahoo sender requirements.
  4. Check blocklists. Other providers may already be blocking the same IP.

Reputation recovers gradually as you send wanted mail at a steady rate. If the deferrals last long enough, the queue lifetime runs out and senders get a bounce instead.

  • 550 5.7.1: a permanent policy rejection, often what follows if the problem continues.
  • 550 5.7.26: rejected because authentication failed.
  • SMTP port 25: where server-to-server mail is delivered.

Check whether your sending IP is listed with the Blacklist Checker, and paste a delivered message into the Email Header Analyzer to see how Gmail authenticated it.