Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
SMTP error code · Gmail / Google Workspace

550 5.7.29: Gmail blocked a message not sent over TLS

550 5.7.29 Permanent failure (5xx): the message bounced
By iBlockSpam Team Checked against sources 4 sources How we check our content
What it means

Gmail blocked (550) or rate limited (421 4.7.29) your message because your server didn't use a TLS connection, which Gmail requires from bulk email senders.

What the bounce says
550 5.7.29 This message was blocked because it wasn't sent over a TLS connection. Gmail requires all bulk email senders to use TLS/SSL for SMTP connections.

Start of the 5.7.29 message in Google's Gmail SMTP errors and codes reference.

What 550 5.7.29 means

Google lists two versions. 421 4.7.29 says your email has been rate limited because you're not using a TLS connection, and 550 5.7.29 says the message was blocked because it wasn't sent over TLS. Both say Gmail requires all bulk email senders to use TLS/SSL for SMTP connections.

Between mail servers, TLS is normally negotiated with STARTTLS: the receiving server advertises it after EHLO, and the sending server upgrades the connection before sending the message. If your server sends in plain text, either STARTTLS is turned off, the server has no usable certificate, or the TLS handshake fails and the server falls back to plain text.

Google's sender guidelines list a TLS connection for transmitting email among the requirements for senders of more than 5,000 messages a day to Gmail accounts, and recommend it for everyone. Check the Received headers of a message you sent to Gmail: they show whether TLS was used. Also note that the IANA registry assigns X.7.29 to "ARC validation failure" (RFC 8617); Gmail's 5.7.29 is about TLS.

Likely causes

  • Outbound STARTTLS is disabled on your mail server or relay.
  • The TLS handshake fails, for example because of outdated protocol versions or ciphers, and the server falls back to plain text.
  • An application or device sends straight to Gmail without TLS.

How to fix it

If you sent the message

  1. Enable opportunistic TLS (STARTTLS) for outbound mail on your server or relay.
  2. Update the mail server software and its TLS settings so a modern handshake succeeds.
  3. Send a test to a Gmail account and check the Received headers for TLS.
  4. Route apps and devices through a relay that uses TLS rather than sending directly.

If you're the recipient or their admin

  1. No action needed at Gmail: the sender has to enable TLS.
Email Deliverability Test MTA-STS Checker Email Header Analyzer

Frequently asked questions

How can I tell whether my mail reached Gmail over TLS?

Open a message you sent to a Gmail account and view the original. The Received header added by Google's server shows the protocol; a TLS version there means the connection was encrypted. Without it, your server sent in plain text.

Does 4.7.29 mean Gmail will accept the message later?

Only if a later attempt uses TLS. 421 4.7.29 rate limits the message and your server retries, but retries without TLS keep failing. Turn on STARTTLS for outbound mail.

Sources

  1. Gmail SMTP errors and codes (Google Workspace Admin Help)
  2. Email sender guidelines (Gmail Help)
  3. RFC 3207: SMTP Service Extension for Secure SMTP over TLS
  4. IANA: SMTP Enhanced Status Codes registry

Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.

Related codes

Related guides

Email security basics

Is my email encrypted in transit? STARTTLS, MTA-STS and DANE explained

What STARTTLS does for email, why opportunistic TLS can be downgraded, how MTA-STS and DANE enforce it, what Gmail's lock icons mean, and where TLS stops.

9 min read Email security basics

SMTP ports 25, 587, 465 and 2525: which one should you use?

Which SMTP port to use: 25 for server-to-server relay, 587 with STARTTLS or 465 with implicit TLS for sending from apps, and why port 25 is often blocked.

10 min read SPF, DKIM & DMARC

Gmail, Yahoo and Microsoft bulk sender requirements explained

What Gmail, Yahoo and Outlook.com require from bulk senders in 2026: SPF, DKIM, DMARC, alignment, one-click unsubscribe, spam rates and the rejection codes.

11 min read