Published · Last verified · Maintained by TamingDNS

↩️ Google / Gmail SMTP Error Code Directory

Google stamps its bounce messages with proprietary identifiers like gsmtp alongside standard SMTP codes. This directory covers every Gmail and Google Workspace rejection you are likely to run into, with a plain-English explanation and a fix for each one.

Provider
Google / Gmail / Google Workspace
Key Identifiers
gsmtp · gcdp · googlemail.com
MX Hostname Pattern
aspmx.l.google.com

How to Identify a Gmail Bounce

Gmail NDRs arrive from [email protected]. The Diagnostic-Code line contains the SMTP code, enhanced code, a human-readable reason, and ends with a [gsmtp] or [gcdp] tag.

Diagnostic-Code: smtp; 550 5.7.26 This message does not pass authentication checks
  (SPF and DKIM both do not pass). To fix this issue, review your SPF and DKIM
  configuration for example.com. [gsmtp]

Google appends [gsmtp] to every error it issues. It appends [gcdp] when the rejection came from a custom rule a Google Workspace administrator wrote, so that tag means a person configured this and no authentication fix will clear it.

Gmail Error Codes

13 codes with Gmail-specific behaviour. Critical (Tier 1) codes appear first.

🟡 421 4.7.0 CRITICAL
Temporary Policy Rejection
Google 421 4.7.0 is a generic temporary hold, often for new IPs or reputation concerns. Back off and retry.
Full explanation & fix →
🟡 421 4.7.28 CRITICAL
Rate Limited: Unusual Volume
Google-specific. Its documented 4.7.28 texts all describe an unusual rate of email, attributed to your IP, netblock, SPF domain, DKIM domain, a URL domain in the body, or a Message-ID quota. Note that IANA registers X.7.28 as "Mail flood detected", so Gmail's use is close to, but not the same as, the registered meaning.
Full explanation & fix →
🟡 450 4.2.1 CRITICAL
Rate Limit: Try Again Later
Google 450 4.2.1: the recipient's receiving rate is exceeded. This is per-recipient, not your sending rate.
Full explanation & fix →
🟡 452 4.2.2 CRITICAL
Mailbox Full (Temporary)
Google returns 452 4.2.2 for over-quota mailboxes, which your server will retry automatically.
Full explanation & fix →
🔴 535 5.7.8 CRITICAL
Authentication Credentials Invalid
Gmail requires an App Password for SMTP auth if 2-Step Verification is enabled. Standard passwords will return 535 5.7.8.
Full explanation & fix →
🔴 550 5.1.1 CRITICAL
Mailbox Does Not Exist
Google returns: "The email account that you tried to reach does not exist. Please try double-checking the recipient's email address for typos or unnecessary spaces."
Full explanation & fix →
🔴 550 5.7.1 CRITICAL
Message Rejected by Policy
Google uses 5.7.1 for both blocklist and policy rejections. Check your IP and domain reputation in Google Postmaster Tools.
Full explanation & fix →
🔴 550 5.7.23 CRITICAL
SPF Validation Failed
Google returns 5.7.23 specifically for SPF hard fails (-all rejection). With ~all (softfail), Google may still accept but DMARC may fail.
Full explanation & fix →
🔴 550 5.7.26 CRITICAL
Multiple Authentication Checks Failed
Gmail issues 5.7.26 for three separate situations and names each in its own text: the sender is unauthenticated (neither SPF nor DKIM passes), the MAIL FROM domain has an SPF -all policy that failed, or a DMARC policy rejects unauthenticated mail. Its bulk-sender rules (Feb 2024) require a DMARC record from senders of 5,000+ messages a day, and the policy may be p=none.
Full explanation & fix →
🔴 552 5.2.2 CRITICAL
Mailbox Over Quota
Google returns 452 4.2.2 (temporary) rather than 552 5.2.2 for quota issues, allowing retries.
Full explanation & fix →
🔴 552 5.2.3 CRITICAL
Message Too Large for Mailbox
Gmail has a 25 MB limit for received messages. Google returns 552 5.2.3 when this is exceeded.
Full explanation & fix →
🔴 552 5.3.4 CRITICAL
Message Too Big for System
Google Workspace has a system-wide 25 MB send limit and 50 MB receive limit. Exceeding these results in 552 5.3.4.
Full explanation & fix →
🟡 421 4.7.29
Rate Limited: No TLS Connection
Google documents 421 4.7.29 as "Your email has been rate limited because you're not using a TLS connection", and requires all bulk senders to use TLS/SSL for SMTP. It is not a new-sender hold. IANA separately registers X.7.29 as "ARC validation failure", so this code does not carry its registered meaning at Gmail.
Full explanation & fix →

Google Bounce Identifier Glossary

[gsmtp]
Google SMTP. Appended to every error Google issues, consumer and Workspace alike, so it tells you the bounce came from Google rather than which service.
[gcdp]
Google Custom Domain Policies. Appended when the rejection came from a custom rule a Google Workspace administrator created, not from Gmail's own filtering. Ask the receiving organisation, not Google.
aspmx.l.google.com
Google's primary inbound MX hostname. If the Remote-MTA in your bounce contains this, the rejection happened at Gmail's receiving gateway.

Gmail 2024 Bulk Sender Requirements

Since February 2024, Google requires all senders of more than 5,000 messages per day to Gmail addresses to meet these standards. Failure results in rejections and deferrals:

  • Valid SPF record authorising your sending IPs, and DKIM signing on your sending domain (either one alone satisfies the rules for senders under the threshold)
  • A DMARC record on the From domain. The policy may be p=none; it just has to exist
  • The From domain aligned with either the SPF domain or the DKIM domain
  • Valid forward and reverse DNS (PTR) for your sending IPs, and TLS on outbound connections
  • Postmaster Tools spam rate below 0.3% (target below 0.1%), and this one applies to every sender, not just bulk
  • One-click unsubscribe header for marketing mail
📖 Google bulk sender requirements →

Frequently Asked Questions

Common questions about Gmail SMTP errors and delivery failures.

The [gsmtp] tag is Google's stamp on the end of its rejection messages. It is not an error code. Google documents it as being added to all errors it issues, so it tells you Google generated the diagnostic rather than a third-party filter in front of it, but not which Google service. [gcdp] is the informative one: Google Custom Domain Policies, added when the rejection came from a custom rule a Google Workspace administrator wrote. That one is resolved by the receiving organisation, not by fixing your authentication.

Google offers Postmaster Tools for free. Once you verify your sending domain, it shows you your domain reputation, IP reputation, spam complaint rates, and a breakdown of any delivery errors. It's one of the most useful free tools available to email senders and well worth setting up.

Because Gmail has seen an unusual volume of mail tied to one of your identifiers and has rate limited it. Every 4.7.28 text Google publishes describes an unusual rate of email, attributed to your IP address, your netblock, your SPF domain, your DKIM domain, a URL in your message body, or a quota on repeated Message-IDs. Recipient complaints feed into Gmail classifying that volume as unsolicited, but the code is not a complaint-rate code. Read the sentence to see which identifier was limited, then check your spam rate in Postmaster Tools and keep it under 0.3%.

No. Google documents 4.7.29 as "Your email has been rate limited because you're not using a TLS connection", and requires bulk senders to use TLS/SSL for SMTP. It is a configuration fix on your side, not a reputation decision, and it clears the moment the connection is encrypted. Check that your MTA offers STARTTLS on outbound mail, that your certificate is valid, and that nothing in the path is stripping the STARTTLS advertisement. (Worth knowing: IANA registers X.7.29 as "ARC validation failure", so this code does not carry its registered meaning at Gmail.)

DMARC has a concept called alignment that trips a lot of people up. SPF passing is not enough on its own. The domain that SPF authenticates must also match the domain in your From address. If you use a third-party sending service, SPF passes for their domain, not yours. The only reliable fix is to set up DKIM signed with your own domain, which gives you the alignment DMARC needs.

🔍

Got a Gmail bounce to decode?

Paste your full NDR email or SMTP error line for an instant plain-English diagnosis.

Open the Bounce Decoder →