421 4.7.32 / 5.7.32: From header not aligned with SPF or DKIM
Gmail rate limited or blocked your message because the domain in the From header doesn't match the organizational domain that passed SPF or DKIM, so DMARC alignment failed.
421 4.7.32 Your email has been rate limited because the From: header (RFC5322) in this message isn't aligned with either the authenticated SPF or DKIM organizational domain.
Start of the 4.7.32 message in Google's Gmail SMTP errors and codes reference.
What 421 4.7.32 means
Google lists two versions. 4.7.32 says your email has been rate limited because the From header isn't aligned with either the authenticated SPF or DKIM organizational domain. 5.7.32 says the email was blocked for the same reason. (Google's table shows the 5.7.32 line with reply code 421; it is still the blocking version.)
Alignment is a DMARC concept. A message can pass SPF and DKIM for some domain and still fail alignment if that domain isn't the one in the visible From address. With the default relaxed alignment, the domains only need the same organizational domain, so mail.example.com aligns with example.com. A typical failure: a sending service signs DKIM with its own domain and uses its own bounce domain for SPF, while your domain is in From.
Google's sender guidelines require that, for direct email from senders of more than 5,000 messages a day, the domain in the From header be aligned with either the SPF domain or the DKIM domain, which is what DMARC alignment requires. The usual fix is to have each sending service sign with DKIM using your domain, or set a custom return-path domain under your own domain.
Likely causes
- A sending service signs DKIM with its own domain instead of yours.
- SPF passes only for the service's bounce (return-path) domain, which isn't your organizational domain.
- The From header uses a domain different from the one you authenticated.
- Mail forwarded or relayed in a way that leaves only a non-aligned authentication result.
How to fix it
If you sent the message
- Configure every sending service to DKIM-sign with your own domain (custom DKIM).
- Where offered, set a custom return-path or bounce domain under your domain so SPF aligns.
- Check the Authentication-Results header of a test message for which domains passed SPF and DKIM.
- Use DMARC aggregate reports to find sources that pass authentication but fail alignment.
If you're the recipient or their admin
- No action needed at Gmail: the sender has to align authentication with the From domain.
Frequently asked questions
My mail passes SPF and DKIM, so why does Gmail say 4.7.32?
Because neither passing domain matches the domain in your From header. Gmail checks alignment: the SPF or DKIM domain must share the From address's organizational domain. A service that authenticates with its own domain passes the checks but fails alignment.
Is 5.7.32 worse than 4.7.32?
Yes. Google says 4.7.32 rate limits the message, so your server retries, while 5.7.32 blocks it. Both have the same fix: authenticate with a domain aligned to your From address.
Sources
- Gmail SMTP errors and codes (Google Workspace Admin Help)
- Email sender guidelines (Gmail Help)
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
- 550 5.7.26 550 5.7.26: Gmail blocked an unauthenticated message
- 550 5.7.27 550 5.7.27: Gmail blocked a message that didn't pass SPF
- 550 5.7.30 550 5.7.30: Gmail blocked a message that didn't pass DKIM
- 550 5.7.40 550 5.7.40: Gmail blocked mail from a domain without a DMARC policy
- 421 4.7.0 421 4.7.0: Gmail is temporarily deferring your mail
- 421 4.7.28 421 4.7.28: Gmail has detected an unusual rate of email
- 452 4.2.2 452 4.2.2: the recipient's inbox is out of storage space
Related guides
DMARC alignment: relaxed vs strict, and what adkim and aspf do
How DMARC alignment works, what adkim and aspf do, how the organizational domain is found, a pass/fail examples table, and when strict alignment is worth it.
9 min read SPF, DKIM & DMARCWhy does DMARC fail? Causes and fixes for dmarc=fail
Troubleshoot dmarc=fail: alignment vs pass, third-party senders, forwarding, subdomains, DKIM d= and SPF MAIL FROM mismatches, with a causes-to-fixes table.
9 min read SPF, DKIM & DMARCHow do you authenticate third-party senders with SPF, DKIM and DMARC?
Make CRMs, helpdesks, newsletters and invoicing tools pass DMARC: inventory senders, set up aligned DKIM and return-path, or move them to a subdomain.
9 min read SPF, DKIM & DMARCHow do you check if an email passed SPF, DKIM and DMARC?
Check SPF, DKIM and DMARC results for any email in Gmail, Outlook and Apple Mail, then read the Authentication-Results header to see why it passed or failed.
11 min read