421 4.7.0: Gmail is temporarily deferring your mail
Gmail temporarily deferred the connection or message for a security reason: a missing reverse DNS record, low reputation, suspicious content, or TLS being required.
421 4.7.0 The IP address sending this message does not have a PTR record, or the corresponding forward DNS entry does not point to the sending IP.
Start of one of eight 421 4.7.0 texts in Google's SMTP errors reference. Gmail's replies can run over several lines; RFC 5321 says every line except the last starts with the code followed by a hyphen, so the same error can appear as 421-4.7.0.
What 421 4.7.0 means
The 4.7.0 part is RFC 3463's "Other or undefined security status": a security reason that doesn't fit a more specific code. Gmail uses 421 4.7.0 with eight different texts, so the words after the code are what matter. They fall into four groups:
- Reverse DNS. The sending IP has no PTR record, or its forward entry doesn't point back to the IP, so Gmail rate limits it.
- Reputation and content. The message looks suspicious because of the very low reputation of the sending IP or domain, or because of its content or links.
- TLS and allow lists. The recipient's domain requires TLS ("TLS required for RCPT domain"), or only accepts mail from listed IPs ("IP not in whitelist for RCPT domain").
- Connection. "Connection expired, try reconnecting" and "Try again later, closing connection".
All are temporary, so your server retries. A connection-level deferral usually clears on the next attempt. Reverse DNS, reputation and TLS deferrals keep coming back until you fix the cause.
Likely causes
- The sending IP has no PTR record, or the PTR doesn't resolve back to the same IP.
- Low reputation of the sending IP address or domain.
- Content or links Gmail considers suspicious.
- The recipient's Google Workspace domain requires TLS, or only accepts listed IPs.
How to fix it
If you sent the message
- Read which 4.7.0 text you got.
- For reverse DNS: set a PTR record on your sending IP that resolves back to it.
- For TLS: enable STARTTLS on your sending server.
- For reputation: check blocklists, authenticate with SPF, DKIM and DMARC, and review what you're sending.
If you're the recipient or their admin
- If you require TLS or an IP allow list in Google Workspace, tell partners, or add their sending IPs.
Frequently asked questions
Why does Gmail say my IP has no PTR record?
Gmail's sender guidelines require the sending IP to have a PTR record that resolves to a host name, which in turn resolves back to the same IP. Set it with whoever controls the IP: your hosting provider, cloud provider or ISP.
Is 421 4.7.0 a permanent block?
No, it's temporary and your server retries. But if the cause is reverse DNS, reputation or TLS, the retries keep failing until it's fixed, and the message eventually bounces.
Sources
- Gmail SMTP errors and codes (Google Workspace Admin Help)
- Email sender guidelines (Gmail Help)
- RFC 3463: Enhanced Mail System Status Codes
- RFC 5321, section 4.2: SMTP replies (multiline reply format)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
- 550 5.7.25 550 5.7.25: reverse DNS validation failed
- 421 4.7.28 421 4.7.28: Gmail has detected an unusual rate of email
- 421 SMTP 421: service not available, closing connection
- 550 5.7.1 550 5.7.1: Gmail blocked likely unsolicited mail or low reputation
- 421 Yahoo 421 / 451 TS errors: message temporarily deferred
Related guides
Reverse DNS and PTR records for mail servers
What a PTR record is, why Gmail, Yahoo and others require forward-confirmed reverse DNS for sending IPs, who can set it, and how to check yours is right.
8 min read Email security basicsIs my email encrypted in transit? STARTTLS, MTA-STS and DANE explained
What STARTTLS does for email, why opportunistic TLS can be downgraded, how MTA-STS and DANE enforce it, what Gmail's lock icons mean, and where TLS stops.
9 min read SPF, DKIM & DMARCGmail, Yahoo and Microsoft bulk sender requirements explained
What Gmail, Yahoo and Outlook.com require from bulk senders: SPF, DKIM, DMARC, alignment, one-click unsubscribe and spam rates, with the real dates and limits.
9 min read