SMTP 421 4.7.26
rate limited, unauthenticated (Gmail)
SMTP 421 4.7.26 is Gmail rate limiting mail because it is not authenticated. Google's message reads "This email has been rate limited because it is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM." It is temporary, but it becomes a permanent 550 5.7.26 if nothing changes.
Should you remove the address?
Keep the address; fix the sending side
Keep it. The address is fine; your message wasn't authenticated.
Soft bounce. Your sending server retries on its own. Investigate only if it keeps failing.
How it appears
421 4.7.26 This email has been rate limited because it is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM.
What causes it
- The message passed neither SPF nor DKIM.
- A new sending service was added without updating SPF or setting up DKIM signing.
- The SPF record is broken, for example by going over the 10-lookup limit.
How to fix it
In order — try the first one first.
- Set up DKIM signing for the domain you send from.
- Make sure every service that sends as your domain is in your SPF record.
- Publish a DMARC record. Google requires it for bulk senders.
- Audit your domain to confirm SPF, DKIM and DMARC all pass.
Who sends it
Gmail. Microsoft 365 uses 4.7.26 for mail sent over IPv6 that is not authenticated.
Gmail
Reply text This email has been rate limited because it is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM.
The reply ends with the authentication results Gmail saw.
Microsoft 365
Reply text Access denied, a message sent over IPv6 <address> must pass either SPF or DKIM validation, this message is not signed
Microsoft's IPv6 rule.
Common questions
- What does SMTP 421 4.7.26 mean?
- SMTP 421 4.7.26 is Gmail rate limiting mail because it is not authenticated. Google's message reads "This email has been rate limited because it is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM." It is temporary, but it becomes a permanent 550 5.7.26 if nothing changes.
- Should I retry a 421 4.7.26 error?
- Yes, and your sending server does it automatically. 421 is a temporary deferral, and legitimate mail usually arrives on a retry within minutes or hours. Only investigate if it persists across many retries.
- How do I fix SMTP 421 4.7.26?
- Set up DKIM signing for the domain you send from.
- Is 421 4.7.26 a hard bounce or a soft bounce?
- 421 4.7.26 is a soft bounce. It is temporary, and your sending server retries it automatically. Your sending server retries on its own. Investigate only if it keeps failing.
- Should I remove the address after a 421 4.7.26 bounce?
- Keep it. The address is fine; your message wasn't authenticated.
- Will verifying my list prevent 421 4.7.26?
- Not directly. This code is about your authentication, IP or domain reputation, so verification will not lift it. A clean list still matters, because mailbox providers weigh how often a sender hits addresses that don't exist.
Clean the list before the next send.
A bounce report only tells you about the addresses you already mailed. The rest of the list has the same kinds of dead mailboxes in it, and each one becomes a hard bounce recorded against your domain the moment you send.
- A real SMTP mailbox check on every row, before anything is sent
- Dead and mistyped addresses split out, so they never reach your sending tool
- Catch-all, disposable and role addresses flagged alongside
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.
Other 421 replies
Sources
- Source: Google Workspace Admin Help: Gmail SMTP errors and codes
- Source: Microsoft Learn: Email non-delivery reports and SMTP errors in Exchange Online
- Source: RFC 3463: Enhanced Mail System Status Codes
Provider wording is quoted only where the provider publishes it.
Last reviewed 2026-10-22