Is 421 4.7.26 permanent or temporary?

421 4.7.26 is a temporary (4.x.x) failure — a properly configured mail server retries automatically, and the message often delivers on a later attempt. Persistent 421 4.7.26 across recipients points to a deeper issue.

Is this my problem or the recipient's?

Often it resolves itself on retry. If it persists across many recipients, it's usually a sending-side reputation or authentication issue worth fixing.

How do I check my sending setup?

Run a free EmailHealth check on your domain — it verifies SPF, DKIM, DMARC, blacklist status, and more in a couple of seconds, which covers the most common causes of delivery failures.

421 4.7.26 — Gmail rate limited unauthenticated email

421 4.7.26 is a temporary SMTP reply meaning gmail rate limited unauthenticated email. Neither SPF nor DKIM passed for this message, so Gmail deferred it. Your server will retry, but if authentication still fails, Gmail starts to reject the mail with 550 5.7.26.

What 421 4.7.26 means

Neither SPF nor DKIM passed for this message, so Gmail deferred it. Your server will retry, but if authentication still fails, Gmail starts to reject the mail with 550 5.7.26.

ℹ️

This is a 4.x.x temporary failure — a correctly configured mail server retries on a backoff schedule, and the message frequently delivers on a later attempt.

Common causes

📨

The service that sent the mail is not in your SPF record

Most common

A new ESP, CRM or cold-email tool sends as your domain, but its include: is missing from SPF.

🔁

DKIM is not set up for that sending service

Most common

The service signs with its own shared domain, or does not sign at all, because the DKIM CNAME or TXT records were never added.

⚙️

Mail is forwarded through a server that breaks SPF

Less common

Forwarding changes the sending IP, so SPF fails. Without DKIM, nothing passes.

How to fix 421 4.7.26

1
Find which service sent the message
Look at the Received and Return-Path headers of the bounced message. That tells you which platform needs SPF and DKIM.
2
Publish DKIM for that service
Add the DKIM records the platform gives you and turn on signing with your own domain. DKIM survives forwarding, so it is the safer of the two.
3
Add the service to SPF and check the result
Add its include: to your single SPF record, keep the total under 10 DNS lookups, then run a free EmailHealth check to confirm both pass.

Confirm your domain is set up correctly

Most delivery failures — permanent or temporary — trace back to authentication or reputation. Run a free EmailHealth check to confirm SPF, DKIM, DMARC, blacklist status, and TLS are all healthy for your sending domain. If you send in volume, free daily monitoring will alert you before a small issue becomes a flood of bounces.

Gmail rate limited unauthenticated email