421 4.7.28 Gmail has detected an unusual rate of unsolicited mail
Last updated 2026-08-14
This is a deferral, not a rejection. Your mail server will retry on its own. What you do in the next hour decides whether it clears this afternoon or turns into a week of throttling.
What it means. Gmail is temporarily rate limiting mail from your IP address or your domain
because its filters see a pattern that looks like unsolicited mail. The
4 means try again later.
What to change. Slow down, fix authentication so reputation accrues to your domain, and find out what changed in your sending. Do not flush the queue in a loop.
When it clears. Often within a few hours for a one-off spike. Days if it is reputation, and only if the underlying sending changes.
The exact deferral
The same code also arrives with "originating from your domain" and the corresponding wording. That single word is the diagnosis. Read it before you do anything else, because the fixes barely overlap.
If it names your IP address
- Are you on a shared relay? If your mail leaves through a shared SMTP pool, your neighbours' behaviour is your reputation. This is the argument for a dedicated IP once your volume justifies one, and against one before it does, because a dedicated IP with low volume never warms up.
-
Check reverse DNS. The sending IP needs a PTR record that resolves
forward to the same host. Missing or generic PTR gets you throttled early:
dig +short -x 203.0.113.24
- Look at what the IP sent in the last day. A compromised account or a script in a retry loop is the usual reason an IP suddenly looks unusual.
If it names your domain
Domain reputation is the harder one and the more honest signal. Changing IPs does nothing for it. Google's Postmaster Tools shows domain reputation, spam rate and authentication rates for domains sending enough volume to register, and it is free. Set it up before you need it, because it needs history to show you anything.
The lever underneath it is authentication. Mail that Gmail can attribute to your domain
through aligned DKIM builds a reputation that follows you. Mail that authenticates as
vendor.net builds theirs. Run the DMARC checker to confirm the record
exists, then check that the platform doing the sending signs with your domain rather than
its own.
What causes the spike
- Volume that jumps by an order of magnitude in a day. A list import, a re-engagement campaign to addresses that have not heard from you in two years, or a migration that resends.
- Complaint rate above Gmail's 0.3% threshold. Postmaster Tools shows this. One bad segment can drag a whole domain.
- Sending to dead addresses. Old lists have spam traps in them, and hitting traps looks exactly like unsolicited mail because it is.
- No authentication, which removes Gmail's ability to tell your good mail from the mail forged as you.
Retry
Leave the queue alone. Standard retry intervals back off on purpose, and forcing a flush every five minutes reads as the exact behaviour that got you throttled. Pause the campaign that triggered it, keep transactional mail flowing, and let the rate come down before you resume. If you are going to resume a bulk send, resume at a fraction of the volume and grow it over days.
Then fix the reason. Throttling that clears on its own and is not investigated comes back bigger, usually as 550-5.7.26 or a spam folder you cannot see from the outside.
You fixed this sender. Tomorrow the reports name the other hosts still sending as you, and we turn a day of XML into one email with a verdict per sender. On the paid plans, the day a report first names a new sender failing, you hear about it. Get the weekly digest. The first domain is free.
Hear about the next failing sender first
This rejection named one sender, and the next to break sends no warning ahead of it. On a paid plan, the first failing report from a new source reaches you as an email that day, not in Monday's digest. Pro watches 5 domains for $19 a month.
Get the alerts and the digestNo card · 12+ months of history · The free plan does not expire
Questions
Will my mail eventually get through?
4.7.28 is a 4xx deferral, so a normal MTA keeps retrying and much of the queue usually delivers within hours. Repeated deferrals over days mean reputation, not a temporary spike, and retrying harder makes that worse.
Does the message mention my IP address or my domain?
Read it carefully, because Gmail issues both variants and they point at different fixes. IP means the sending host's reputation, which a shared relay can poison. Domain means yours, and moving to a new IP will not help.
How does authentication affect throttling?
Unauthenticated mail has no identity for Gmail to build reputation against, so it gets throttled far sooner and recovers more slowly. Aligned DKIM lets good behaviour accumulate against your domain rather than an IP you may share.
Keep reading
Checking as you fix? Our DMARC checker, SPF checker and DKIM checker read the records live, no signup.