Gmail rejecting your emails? Sender requirements and error codes explained

What changed, and when

Google announced its sender requirements in October 2023, together with Yahoo, and began enforcing them on 1 February 2024, describing enforcement as "gradual and progressive" - in practice a mix of temporary deferrals and rejections that grew over time. In June 2024 the spam-rate rule gained teeth - bulk senders whose user-reported spam rate is above 0.3% became ineligible for mitigation (Google won't help them until the rate has stayed below 0.3% for seven consecutive days). In November 2025 Google updated its sender FAQ to say that Gmail is "ramping up its enforcement on non-compliant traffic", which in practice means more temporary and permanent rejections for mail that breaks the rules.

The rules apply to mail sent to personal Gmail accounts (@gmail.com). Mail to Google Workspace domains is filtered by Google too, but these specific requirements are defined for personal accounts.

Requirements for every sender

Whatever your volume, Google's email sender guidelines require you to:

• authenticate your mail with SPF or DKIM (Google recommends both, and a 2048-bit DKIM key),
• send from IP addresses with valid forward and reverse DNS - a PTR record whose hostname resolves back to the IP,
• use a TLS connection to transmit mail,
• keep the spam rate reported in Postmaster Tools below 0.3%,
• format messages according to RFC 5322 (one valid From: header, a valid Message-ID and so on),
• not impersonate Gmail From: headers - you can't send "from" a gmail.com address through your own server.

Additional requirements for bulk senders

Google defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours. Two details catch people out: all mail from the same primary domain counts together (2,500 from news.example.com plus 2,500 from shop.example.com makes example.com a bulk sender), and the status doesn't expire - a domain that crosses the line once is treated as a bulk sender permanently. On top of the rules above, bulk senders must:

• publish both SPF and DKIM for the sending domain,
• publish a DMARC record - p=none is enough to meet the requirement,
• align the domain in the visible From: header with the SPF domain or the DKIM signing domain, so that DMARC passes,
• support one-click unsubscribe (RFC 8058) in marketing and subscribed mail, show a visible unsubscribe link in the body, and honor unsubscribe requests within 48 hours,
• keep the user-reported spam rate below 0.3% - Google's guidance is to aim for under 0.1%.

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

p=none only satisfies the requirement - it doesn't protect your domain from spoofing. Use the reports to move to p=quarantine or p=reject once all your legitimate mail passes.

Yahoo's rules are almost the same

Yahoo (which also handles AOL mail) started enforcing a matching set of rules in February 2024. All senders must use SPF or DKIM, have valid forward and reverse DNS, comply with RFC 5321 and RFC 5322 and keep the spam rate below 0.3%. Bulk senders must publish SPF and DKIM, a DMARC policy of at least p=none that passes, an aligned From: domain, a working List-Unsubscribe header (Yahoo strongly recommends the RFC 8058 one-click POST method), a visible unsubscribe link, and honor unsubscribes within two days. Yahoo doesn't publish a numeric bulk-sender threshold. A domain that satisfies Gmail's list satisfies Yahoo's as well.

Decoding Gmail's rejection messages

Gmail's bounces are unusually specific: the enhanced status code plus the text tell you exactly which rule failed. A 4.x.x code is a temporary deferral - your server will retry, but repeated deferrals mean the problem is real. A 5.x.x code is a permanent rejection. The most common ones, with Google's own wording:

Not every bounce from Gmail is about you as a sender. 550 5.1.1 means the address doesn't exist, 452 4.2.2 means the recipient's mailbox is full, and 450 4.2.1 means that recipient is receiving mail too quickly. The first one is a hard bounce - remove the address; the other two are temporary. See the guide to SMTP bounce codes for how the codes are built.

How to diagnose a Gmail rejection

1. Read the whole bounce. Copy the full status line from the bounce message or your server's log, not only the three-digit code - 550 5.7.1 alone has twenty different explanations.
2. Check your DNS. Look up SPF, DKIM and DMARC for the domain in your From: address with the email authentication checker. One SPF record, within 10 lookups, a DKIM key for the selector your sender uses, and a DMARC record.
3. Send a test to a Gmail address and open "Show original". Gmail shows SPF, DKIM and DMARC results at the top, and the Authentication-Results header tells you which domain each one was evaluated for - that's how you spot an alignment problem.
4. Check reverse DNS and TLS if you run your own server: the PTR of your sending IP must resolve back to the same IP, and your server must offer STARTTLS when it connects to Gmail.
5. Check reputation. Register your domain in Google Postmaster Tools (it's verified with a DNS TXT or CNAME record) to see your spam rate, authentication rates, encryption and delivery errors. Dashboards stay empty until you send enough daily volume.

Requesting mitigation

If you're a bulk sender, have fixed everything and still see rejections, Google's sender contact form accepts mitigation requests - but only from senders that meet all the requirements, and not while the spam rate is at or above 0.3% (it must stay below that for seven days first). There's no form that lifts rejections for unauthenticated mail; fixing authentication is the only path.

Common situations

"Everything passes, but mail from our newsletter tool bounces"

The usual cause is alignment. Many marketing platforms send with their own domain in the envelope (so SPF passes for their domain) and sign DKIM with their own domain too. DMARC then fails for yours. Set up the platform's "custom domain" or "domain authentication" option, which publishes DKIM keys under your domain.

"Only some messages are rejected"

Enforcement is applied to a percentage of non-compliant traffic, and some rules (like the unusual-rate deferrals) only trigger above certain volumes. Sporadic 4.7.x deferrals are an early warning - fix the cause before they turn into 5.7.x rejections.

"We run our own server and mail to Gmail is deferred with 421 4.7.0"

Check reverse DNS first; a missing or generic PTR record is the classic cause. A brand-new IP address with no history is the second: start slowly, as described in the warm-up guide.

How AnyMail handles this

With AnyMail, the server-side items on Google's list are covered for every mail server: mail is DKIM-signed with a 2048-bit key for your own domain, sent over TLS when the receiving server supports it, from an IP with matching forward and reverse DNS, and every message to an external recipient carries a one-click List-Unsubscribe header. The DNS records you publish are generated for you and checked automatically, and new mail servers start with a lower hourly sending limit that rises over two weeks. What stays with you is the part no provider can do: sending mail people asked for, so they don't report it as spam. If you're seeing rejections from mail elsewhere, start with the guide to why mail goes to spam.