Mail errors · Gmail

What does “421 4.7.27 Your email has been rate limited because SPF authentication didn't pass for this message” mean?

The server that sent the message is not in your SPF record.

Last read from the sources at the foot of this page.

Check my firm Read the steps
Gmail bounce
Mail Delivery Subsystem
421 4.7.27

Your email has been rate limited because SPF authentication didn't pass for this message

As Gmail prints it.
01

What does it mean?

Gmail looked up the SPF record of the sending domain and did not find the sending server in it. 421 is a temporary limit; 550 5.7.27 is a block.

02

What exactly does the source say?

421 4.7.27 Your email has been rate limited because SPF authentication didn't pass for this message. Gmail requires all bulk email senders to authenticate their email with SPF. Authentication results: SPF domain-name with IP address: ip-address = Did not pass. To set up SPF for your sending domains, visit Set up SPF. To learn more about Gmail requirements for bulk email senders, visit Email sender guidelines.

Gmail's page writes domain-name and ip-address where your bounce shows your own domain and the sending address.

Same fix: 550 5.7.27
550 5.7.27 This message was blocked because it didn't pass SPF authentication. Gmail requires bulk email senders to authenticate their email with SPF. Authentication results: SPF with ip-address = did not pass To set up SPF for your sending domains, visit Set up SPF. To learn more about Gmail requirements for bulk email senders, visit Email sender guidelines.
03

Why would a small firm see it?

A service that sends as your domain is missing from the record, or the record has two copies, or it makes more than 10 lookups and fails as a whole.

04

How do I fix it?

  1. List every service that sends mail as your domain: your mailboxes, your invoicing or accounting tool, your booking system, your newsletter tool, your website's contact form.
  2. Find each service's SPF include in its own help pages.
  3. Send yourself a message through the service and open its headers.Look for spf=pass.

Keep one SPF record. Add the service inside the one record you have, before its last word, and keep every service already in it. A second SPF record makes the check fail for every message.

An SPF record may make at most 10 DNS lookups. Each include counts, and so do the includes inside it. Past 10 the check fails, so take out services you no longer use before adding a new one.

Sources

Where does this come from?

Related
06 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy