What it looks like in your logs
421-4.7.26 This mail has been rate limited because it is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM. Authentication results: DKIM = did not pass, SPF [example.com] with ip: [203.0.113.10] = did not pass - gsmtpWhat does 4.7.26 mean?
Enhanced code 4.7.26 is the temporary form of multiple authentication checks failed. The message failed SPF and DKIM, or failed them in a way the receiver cares about, and instead of rejecting outright, the receiver is deferring it. Your server will retry, but unless something changes the retries will fail the same checks. Treat it as a configuration fault that happens to use a temporary code.
Gmail began using 421 4.7.26 widely when its February 2024 sender requirements came into force: mail that passes neither SPF nor DKIM is rate limited, and the text lists the authentication results. A second Gmail text says temporary DNS failures prevented authentication, which is genuinely transient because your SPF or DKIM lookup simply timed out. Only that second form fixes itself.
Microsoft 365 also uses 4.7.26 for a rule that surprises many senders: mail sent over IPv6 must pass SPF or DKIM. The same server may deliver fine over IPv4 while its IPv6 traffic is deferred, which looks random until you compare address families.
Soft or hard bounce?
| Soft bounce (4xx) | Hard bounce (5xx) | |
|---|---|---|
| Nature | Temporary | Permanent |
| Sender behaviour | Queue and retry with backoff | Stop, suppress the address |
| Reputation risk | Low, unless it repeats for days | High above a 2% bounce rate |
| 4.7.26 | ✓ this code |
Common causes
- The message passed neither SPF nor DKIM.
- The SPF record does not include the IP, often an IPv6 address, that actually sent the mail.
- DKIM signing is set up for one sending path or service but not another.
- A temporary DNS failure stopped the receiver from completing the SPF or DKIM lookup.
- Your DNS host is slow or rate limits large resolvers.
How to fix 4.7.26
- Read the text: a DNS failure is transient, a rate limit for unauthenticated mail is not.
- Check SPF with the SPF checker and add every IPv4 and IPv6 address or include your mail actually leaves from.
- Enable DKIM signing with your own domain on every sending service and confirm it with the DKIM checker.
- If you cannot cover IPv6 quickly, configure your MTA to send over IPv4 until SPF and DKIM are fixed.
- Send a test message and read the Authentication-Results header with the header analyzer.
- Reduce volume to the affected provider until authentication passes consistently.
4.7.26 questions
What does 421 4.7.26 mean from Gmail?
It means Gmail is rate limiting your message because it is unauthenticated: SPF and DKIM did not pass. It is temporary in form, but it keeps happening until you fix authentication. If you leave it, Gmail can move to the permanent 5.7.26.
Is 4.7.26 transient or a real problem?
It depends on the text. If Gmail says temporary DNS failures prevented authentication, a retry may succeed once your DNS responds. If it says the mail is unauthenticated and rate limited, it is a configuration problem and retries alone will not fix it.
Why does Microsoft defer my IPv6 mail but accept IPv4?
Microsoft requires mail sent over IPv6 to pass SPF or DKIM, with no leniency. If your SPF record only lists IPv4 addresses and you do not sign with DKIM, IPv6 deliveries fail while IPv4 ones pass. Add your IPv6 range to SPF and sign every message.