Gmail SMTP Errors and Troubleshooting
Complete catalog of Gmail SMTP reply codes with their enhanced status codes, meanings, and fixes.
Referencesenderesp-operator
Google publishes the SMTP reply codes its servers return when rejecting, deferring, or rate-limiting inbound mail. Every Gmail-generated error ends with the identifier gsmtp; errors that also contain gcdp were triggered by a custom rule configured by a Google Workspace administrator on the receiving domain (not by Gmail's own filtering).
General rules of thumb:
- 4xx codes are temporary — retry later; many 4.7.x codes are deliberate rate limiting that escalates to a 5.7.x permanent block if the underlying problem isn't fixed.
- 5xx codes are permanent for that message — fix the cause before resending.
- The compliance-driven 4.7.x/5.7.x pairs (SPF, DKIM, DMARC, TLS, PTR, alignment) map directly to the Gmail sender requirements.
Temporary failures (4xx)
| Code | Message (abridged) | Meaning / fix |
|---|---|---|
| 450-4.2.1 | User "is receiving email too quickly" / "at a rate that prevents delivery" | Recipient-side rate limit; resend later |
| 450-4.2.1 | "Peak SMTP relay limit exceeded for this customer" | Workspace SMTP relay limit; contact the account administrator |
| 452-4.2.2 | "The recipient's inbox is out of storage space" | Recipient must free Google storage |
| 421-4.3.0 | "Temporary System Problem. Try again later" | Google-side issue; retry |
| 451-4.3.0 | "Email server has temporarily rejected this message" | Retry later |
| 451-4.3.0 | "Multiple destination domains per transaction is unsupported" | Send one destination domain per SMTP transaction (RFC 5321) |
| 451-4.4.2 | "Timeout - closing connection" | Network/session timeout; retry |
| 421-4.4.5 | "Server busy, try again later" | Retry with backoff |
| 451-4.5.0 | "SMTP protocol violation" | Fix client protocol handling per RFC 5321 |
| 452-4.5.3 | "Domain policy size per transaction exceeded" | Retry that recipient in a separate transaction |
| 452-4.5.3 | "Your message has too many recipients" | Reduce recipients per message |
| 421-4.7.0 | "Connection expired, try reconnecting" / "Try again later, closing connection" | Reconnect and retry |
| 421-4.7.0 | "IP not in whitelist for RCPT domain" | Receiving (Workspace) domain only accepts allowlisted IPs |
| 421-4.7.0 | "The IP address sending this message does not have a PTR record" | Add matching PTR/forward DNS |
| 421-4.7.0 | "TLS required for RCPT domain, closing connection" | Deliver over TLS |
| 421-4.7.0 | "This message is suspicious due to the very low reputation of the sending IP / sending domain" | Reputation block; see reputation recovery below |
| 421-4.7.0 | "This message is suspicious due to the nature of the content" | Content flagged; review message content |
| 454-4.7.0 | "Too many login attempts" / "Cannot authenticate due to a temporary system problem" | Client-auth throttling; retry later |
| 451-4.7.23 | "The sending IP address for this message doesn't have a PTR record" | Add PTR record |
| 451-4.7.24 | "The SPF record of the sending domain has one or more suspicious entries" | Clean up the SPF record (remove compromised/suspicious includes) |
| 421-4.7.26 | "Rate limited because it is unauthenticated" | Set up SPF or DKIM |
| 451-4.7.26 | "Unauthenticated email from domain is not accepted due to domain's DMARC policy" | The From: domain's own DMARC policy rejects unauthenticated use; authenticate with aligned SPF/DKIM |
| 421-4.7.27 | "Rate limited because SPF authentication didn't pass" | Fix SPF |
| 421-4.7.28 | "Unusual rate of email" from your IP address / IP netblock / DKIM domain / SPF domain / a URL domain in the body; or "sender exceeded the quota" | Spam-pattern rate limiting keyed to that identifier. Recovery: wait ≥10 minutes, resume with one connection, add connections one at a time |
| 421-4.7.29 | "Rate limited because you're not using a TLS connection" | Enable TLS |
| 421-4.7.30 | "Rate limited because DKIM authentication didn't pass" | Fix DKIM |
| 421-4.7.32 | "Rate limited because the From: header isn't aligned" with SPF/DKIM domain | Achieve DMARC alignment — see DMARC |
| 421-4.7.40 | "Rate limited because the sending domain doesn't have a DMARC record" | Publish a DMARC record (minimum p=none) |
Permanent failures (5xx)
Recipient and addressing
| Code | Message (abridged) | Meaning / fix |
|---|---|---|
| 550-5.1.1 | "The email account that you tried to reach does not exist" | Hard bounce — remove the address; check for typos |
| 553-5.1.2 | "We weren't able to find the recipient domain" | Bad domain; check spelling/MX |
| 553-5.1.3 | "The recipient address is not a valid RFC 5321 address" | Fix address syntax |
| 553-5.1.7 | "The sender address is not a valid RFC 5321 address" | Fix envelope-sender syntax |
| 550-5.2.1 | "The email account that you tried to reach is inactive" | Disabled account; suppress |
| 550-5.2.1 | User "is receiving email at a rate that prevents delivery" | Recipient rate limit |
| 552-5.2.2 | "The recipient's inbox is out of storage space and inactive" | Suppress or wait |
| 550-5.4.5 | "Daily user sending limit exceeded" / "Daily SMTP relay limit exceeded for user" | Gmail/Workspace outbound limits reached |
| 554-5.4.6 | "Message exceeded 50 hops" | Likely a mail loop; investigate forwarding chains |
| 550-5.5.3 | "Too many recipients for this sender" | Reduce recipient count |
Size limits
| Code | Message (abridged) | Meaning / fix |
|---|---|---|
| 552-5.3.4 | Message exceeded size limits | Total message too large |
| 552-5.3.4 | "The number of attachments exceeds Google's limit" | Fewer attachments |
| 552-5.3.4 | Header size limits exceeded — total headers, a header value, a header name, or the Subject: header |
Shrink headers |
Protocol and session
| Code | Message (abridged) | Meaning / fix |
|---|---|---|
| 502-5.5.1 | "Unimplemented command" / "Unrecognized command" / "Too many unrecognized commands, goodbye" | Fix SMTP client behavior |
| 503-5.5.1 | "Bad sequence of commands" / "EHLO/HELO first" / "RCPT first" / "No DATA after BDAT" (RFC 3030) | Command-ordering bug in the client |
| 501-5.5.2 / 555-5.5.2 | "Syntax error" | Malformed SMTP command |
| 501-5.5.4 | "HELO/EHLO argument invalid" / "Empty HELO/EHLO argument not allowed" | Send a valid FQDN in HELO/EHLO |
| 530-5.7.0 | "Must issue a STARTTLS command first" (RFC 3207) / "Authentication required" | Start TLS / authenticate before sending |
| 523-5.7.10 | "No commands allowed to pipeline after STARTTLS" | RFC 3207 violation |
| 501-5.7.11 | "Syntax error (no parameters allowed)" | RFC 3207 violation |
| 554-5.7.0 | "Too many unauthenticated commands" | Session terminated |
| 503-5.7.0 | "No identity changes permitted" | Don't switch authenticated identity mid-session |
Content, format, and policy
| Code | Message (abridged) | Meaning / fix |
|---|---|---|
| 554-5.6.0 | "Email message is malformed. Not accepted" | Fix RFC 5322 compliance |
| 552-5.7.0 | "Content presents a potential security issue" | Blocked attachment/file type (see Gmail's blocked file types) |
| 550-5.7.1 | "The user or domain that you are sending to has a policy" prohibiting the mail | Receiving Workspace domain policy (gcdp errors); contact the recipient's administrator |
| 550-5.7.1 | "This message is likely unsolicited email" / "likely suspicious due to the very low reputation" of the sending IP or domain | Spam/reputation block; see recovery below |
| 550-5.7.1 | RFC 5322 violations: missing/invalid From:, multiple From: headers, multiple addresses in From:, missing valid Message-ID:, duplicate headers, malformed header, non-compliant From: value, encoded-word syntax in a header, unicode character in a disallowed header |
Fix message generation per RFC 5322 |
| 550-5.7.1 | "This message does not meet IPv6 sending guidelines" | Over IPv6, PTR records and authentication are mandatory; fix or send via IPv4 |
| 550-5.7.1 | "This email has been rate limited" | Sending/receiving limits |
| 550-5.7.1 | "The IP you're using to send email is not authorized" | Sending directly from a dynamic/consumer IP; relay through your provider's SMTP instead |
| 550-5.7.1 | "Invalid credentials for relay" / "Daily SMTP relay sending limit exceeded for this customer" | Workspace SMTP-relay configuration/limits |
| 550-5.7.0 | "Email relay denied" (invalid credentials / suspended account) | Register the sending IP in Workspace SMTP relay settings, or the relay account is suspended for spam |
Authentication and sender-requirement blocks
| Code | Message (abridged) | Meaning / fix |
|---|---|---|
| 550-5.7.24 | "SPF record of the sending domain has one or more suspicious entries" | Clean the SPF record |
| 550-5.7.25 | "The sending IP address doesn't have a PTR record" | Add PTR |
| 550-5.7.26 | "Blocked because the sender is unauthenticated" | Set up SPF or DKIM |
| 550-5.7.26 | "The (E)MAIL FROM domain has an SPF record with a hard fail policy" (-all) but the message failed SPF |
Fix the SPF record or send from an authorized IP |
| 550-5.7.26 | "Unauthenticated email from domain is not accepted due to domain's DMARC policy" | Aligned authentication required by the From: domain's DMARC |
| 550-5.7.27 | "Didn't pass SPF authentication" | Fix SPF |
| 550-5.7.28 | "Unusual rate of unsolicited email originating from your IP address" | Spam-volume block; stop, fix list hygiene, warm back up |
| 550-5.7.29 | "Wasn't sent over a TLS connection" | Enable TLS |
| 550-5.7.30 | "Didn't pass DKIM authentication" | Fix DKIM |
| 5.7.32 | "Blocked because the From: header isn't aligned" with SPF/DKIM | Fix DMARC alignment |
| 550-5.7.40 | "The sending domain doesn't have a DMARC record" | Publish DMARC |
Client-authentication errors (submission, not deliverability)
| Code | Message (abridged) | Meaning / fix |
|---|---|---|
| 535-5.7.80 | "Username and Password not accepted" | Bad credentials / blocked sign-in |
| 534-5.7.90 | "Application-specific password required" / "Please log in with your web browser" | Use app passwords or OAuth |
| 534-5.7.14 | "Please log in through your web browser and then try again" | Account security challenge |
| 504-5.7.40 | "Unrecognized authentication type" / "XOAUTH is no longer supported" | Use OAuth 2.0 (XOAUTH2) |
Recovering from blocks and throttling
- Temporary 4.7.x failures are throttling, not final verdicts. Google's guidance: "completely stop sending for a short period of time, then resume sending at a slower rate" — effectively re-warming.
- Rate-limit quota errors (4.7.28): wait at least 10 minutes, resume with a single connection, add connections one at a time; if a single connection still fails, wait another 10 minutes.
- Reputation blocks ("very low reputation of the sending IP/domain"): check the IP and Domain Reputation dashboards in Postmaster Tools, fix the spam source, and allow time — reputation recovers only through sustained compliant sending.
- Public blocklist (RBL) listings: Gmail also consults public blocklists; request delisting from the blocklist operator directly.
- Persistent blocks on compliant traffic: use Google's Bulk Sender Escalation Form — but note mitigation is unavailable while the Postmaster Tools spam rate exceeds 0.3% (see sender requirements).
#gmail#google#smtp#error-codes#bounces#troubleshooting#rate-limiting#rejection