# 421 4.7.0: Gmail is temporarily deferring your mail

URL: https://iblockspam.com/smtp-errors/421-4-7-0
Last updated: 2026-10-09

Code: 421 4.7.0 (temporary failure, the sender retries)
Provider: Gmail / Google Workspace

Gmail temporarily deferred the connection or message for a security reason: a missing reverse DNS record, low reputation, suspicious content, or TLS being required.

What the bounce says:

```
421 4.7.0 The IP address sending this message does not have a PTR record, or the corresponding forward DNS entry does not point to the sending IP.
```
Start of one of eight 421 4.7.0 texts in Google's SMTP errors reference. Gmail's replies can run over several lines; RFC 5321 says every line except the last starts with the code followed by a hyphen, so the same error can appear as 421-4.7.0.

The 4.7.0 part is RFC 3463's "Other or undefined security status": a security reason that doesn't fit a more specific code. Gmail uses 421 4.7.0 with eight different texts, so the words after the code are what matter. They fall into four groups:

- **Reverse DNS.** The sending IP has no PTR record, or its forward entry doesn't point back to the IP, so Gmail rate limits it.
- **Reputation and content.** The message looks suspicious because of the very low reputation of the sending IP or domain, or because of its content or links.
- **TLS and allow lists.** The recipient's domain requires TLS ("TLS required for RCPT domain"), or only accepts mail from listed IPs ("IP not in whitelist for RCPT domain").
- **Connection.** "Connection expired, try reconnecting" and "Try again later, closing connection".

All are temporary, so your server retries. A connection-level deferral usually clears on the next attempt. Reverse DNS, reputation and TLS deferrals keep coming back until you fix the cause.

## Common causes

- The sending IP has no PTR record, or the PTR doesn't resolve back to the same IP.
- Low reputation of the sending IP address or domain.
- Content or links Gmail considers suspicious.
- The recipient's Google Workspace domain requires TLS, or only accepts listed IPs.

## How to fix it (sender)

- Read which 4.7.0 text you got.
- For reverse DNS: set a PTR record on your sending IP that resolves back to it.
- For TLS: enable STARTTLS on your sending server.
- For reputation: check blocklists, authenticate with SPF, DKIM and DMARC, and review what you're sending.

## How to fix it (recipient or admin)

- If you require TLS or an IP allow list in Google Workspace, tell partners, or add their sending IPs.

**Q: Why does Gmail say my IP has no PTR record?**
Gmail's sender guidelines require the sending IP to have a PTR record that resolves to a host name, which in turn resolves back to the same IP. Set it with whoever controls the IP: your hosting provider, cloud provider or ISP.

**Q: Is 421 4.7.0 a permanent block?**
No, it's temporary and your server retries. But if the cause is reverse DNS, reputation or TLS, the retries keep failing until it's fixed, and the message eventually bounces.

Sources:
- Gmail SMTP errors and codes (Google Workspace Admin Help): https://knowledge.workspace.google.com/admin/support/troubleshooting/gmail-smtp-errors-and-codes
- Email sender guidelines (Gmail Help): https://support.google.com/mail/answer/81126
- RFC 3463: Enhanced Mail System Status Codes: https://www.rfc-editor.org/rfc/rfc3463
- RFC 5321, section 4.2: SMTP replies (multiline reply format): https://www.rfc-editor.org/rfc/rfc5321#section-4.2

---

Source: iBlockSpam, https://iblockspam.com/smtp-errors/421-4-7-0 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt