MailFixIt

Gmail temporary authentication deferral

Gmail 421 4.7.26: This email has been rate limited because it is unauthenticated

Gmail temporarily deferred the message because neither the reported SPF check nor DKIM signature passed.

Problem description

The Gmail response contains:

421 4.7.26 This email has been rate limited because it is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM. Authentication results: DKIM = did not pass; SPF [domain-name] with ip: [ip-address] = did not pass.

Run this automated test on my domain

Enter your domain. MailFixIt checks the relevant DNS records automatically and shows the evidence.
Is this temporary or permanent?

SMTP 421 is temporary. Keep normal retries with backoff, but correct the failed authentication path if the response repeats.

Fix the sending path

  1. Save the complete response. It names the sending IP and SPF domain.
  2. Check that the IP is authorized by that domain’s SPF record.
  3. Inspect the original message for a DKIM d= domain and s= selector.
  4. If DKIM should be present, confirm that the service signs the message and that the exact selector record is published.
  5. Send a new message through the same service and confirm that SPF or DKIM passes.

If this is bulk mail, also confirm that the passing SPF or DKIM domain aligns with the visible From domain for DMARC.

Keep normal retries

Do not retry rapidly or switch IPs to evade the limit. Gmail controls the temporary rate limit. Authentication fixes make later attempts eligible; they do not guarantee immediate acceptance.

Frequently asked questions

Will Gmail retry this message?

The sending server should retry a 421 response with increasing delay. Repeated unauthenticated attempts still need a configuration fix.

Do both SPF and DKIM need to pass?

This response says either SPF or DKIM must pass. For bulk sending, configure DMARC too and make SPF or DKIM align with the visible From domain.

Related email diagnostics

Gmail 550 5.7.26: This email has been blocked because the sender is unauthenticatedDiagnose Gmail 550 5.7.26 safely. Separate unauthenticated-mail, SPF hard-fail and DMARC-policy branches before changing email DNS. Gmail 550 5.7.27: This message didn't pass SPF authenticationDiagnose Gmail 550 5.7.27 using the actual sending IP and envelope MAIL FROM domain, then correct only the SPF or sender path that failed. Gmail 550 5.7.30: This message was blocked because it didn't pass DKIM authenticationDiagnose Gmail 550 5.7.30 DKIM authentication failures with the exact selector and signing domain from message headers before changing DNS.

Primary sources: Gmail SMTP errors and codes, Google email sender guidelines.