X.7.28 · Security or policy
SMTP enhanced status code 5.7.28
Mail flood detected
X.7.28 means the message looks like part of a flood of similar abusive messages. Gmail uses 4.7.28 and 5.7.28 for an unusual rate of unsolicited mail from an IP, domain or URL.
| Registry code | X.7.28 |
|---|---|
| Forms in use | 5.7.28, 4.7.28 |
| Registry name | Mail flood detected |
| Subject | 7: Security or policy |
| Permanent or temporary | 4.x.x persistent transient failure: retrying later may succeed; 5.x.x permanent failure: resending unchanged will not succeed |
| Associated basic codes | . |
| Defined in | [draft-levine-mailbomb-header-00] |
What the registry says
The message appears to be part of a mail flood of similar abusive messages.
IANA SMTP Enhanced Status Codes registry, X.7.28
In practice
X.7.28 marks a flood of similar abusive messages. Gmail uses 421 4.7.28 and 550 5.7.28 when it sees an unusual rate of unsolicited mail from your IP, netblock, DKIM domain, SPF domain or a URL in the message. Volume spikes, cold lists and high complaint rates are the usual triggers. Slow down and clean the list.
What the sender should do
Slow down, stop sending to unengaged and unverified addresses, and look at complaint rates before sending again.
Would verifying the list have prevented 5.7.28?
Partly
The reply is not only about one address, but providers weigh how often a sender hits addresses that do not exist. Removing bad addresses before sending lowers that signal.
How providers use X.7.28
Quoted from each provider’s own error reference.
- Gmail 421 4.7.28
Gmail has detected an unusual rate of email. To protect our users from spam, email has been temporarily rate limited. To review our bulk email senders guidelines, go to Email sender guidelines.
- Gmail 550 5.7.28
There is an unusual rate of unsolicited email originating from your IP address. To protect our users from spam, email sent from your IP address has been blocked. To review our bulk email senders guidelines, go to Email sender guidelines.
Common questions
- What does 5.7.28 mean?
- X.7.28 means the message looks like part of a flood of similar abusive messages. Gmail uses 4.7.28 and 5.7.28 for an unusual rate of unsolicited mail from an IP, domain or URL.
- What is the difference between 5.7.28 and 4.7.28?
- They share the subject and detail digits, so they report the same condition, "Mail flood detected". The first digit is the class: 4.x.x persistent transient failure: retrying later may succeed; 5.x.x permanent failure: resending unchanged will not succeed.
- What should I do about 5.7.28?
- Slow down, stop sending to unengaged and unverified addresses, and look at complaint rates before sending again.
- Would an email verifier have caught 5.7.28?
- Partly. The reply is not only about one address, but providers weigh how often a sender hits addresses that do not exist. Removing bad addresses before sending lowers that signal.
Full guides for this code
Sources
- IANA: SMTP Enhanced Status Codes registry (checked 2026-11-05)
- RFC 3463: Enhanced Mail System Status Codes (checked 2026-11-05)
- Google Workspace Admin Help: Gmail SMTP errors and codes (checked 2026-11-05)
Registry and provider wording is quoted exactly; guidance is written by the SimpleVerifier Team.
SimpleVerifier Team · Last checked against the sources 2026-11-05