What it looks like in your logs
550-5.7.28 [203.0.113.10] Our system has detected an unusual rate of unsolicited mail originating from your IP address. To protect our users from spam, mail sent from your IP address has been blocked. - gsmtpWhat does 5.7.28 mean?
The IANA registry lists X.7.28 as mail flood detected: the message looks like part of a flood of similar abusive messages. The permanent form means the receiver has moved past throttling and is refusing your traffic outright. It is one step beyond 4.7.28, which is the temporary rate limit that usually comes first. Your server will not retry it, and it should not, because further volume makes the problem worse.
Gmail is the main source. It returns 550 5.7.28 when it sees an unusual rate of unsolicited mail from your IP address or from a wider sending pattern, and it bases the decision on complaints, spam-folder placement and how suddenly your volume changed. It is not a fixed message count. A new IP sending 50,000 emails on day one can trigger it, and so can a compromised account sending spam.
Treat it as urgent. First rule out a compromise, because a hijacked mailbox or web form is a common cause. Then look at list source, complaint rate and volume pattern before sending anything else to that provider.
Soft or hard bounce?
| Soft bounce (4xx) | Hard bounce (5xx) | |
|---|---|---|
| Nature | Temporary | Permanent |
| Sender behaviour | Queue and retry with backoff | Stop, suppress the address |
| Reputation risk | Low, unless it repeats for days | High above a 2% bounce rate |
| 5.7.28 | ✓ this code |
Common causes
- A compromised account, server or web form is sending spam through your infrastructure.
- A campaign went to a large, stale or purchased list and generated heavy complaints.
- Volume from a new or cold IP rose far faster than the receiver expects.
- Your spam complaint rate at Gmail moved above the 0.3% ceiling.
- Messages were sent in a sudden burst rather than spread over time.
How to fix 5.7.28
- Check outbound logs for unexpected senders, recipients or volume, and lock down any compromised account or form.
- Pause sending to Gmail and review complaint and spam rates in Google Postmaster Tools.
- Remove unengaged, bounced and unclear-consent addresses before sending again.
- Resume at a fraction of your previous volume to engaged recipients only, and raise it over two to four weeks.
- Use the IP and domain warmup guide as a schedule, and check the sender reputation checker and blacklist checker during recovery.
5.7.28 questions
What does 550 5.7.28 mean in Gmail?
It means Gmail has blocked mail from your IP or domain because it looks like a flood of unsolicited messages. It is based on recipient complaints, spam placement and volume patterns. It is more serious than the temporary 4.7.28 and needs a change in how and to whom you send.
How many emails trigger a 5.7.28 block?
There is no published number. Gmail looks at reputation and behavior, not a raw count. A well-warmed IP with low complaints can send large volumes, while a new IP or a poorly sourced list can be blocked at a few thousand. Keep complaints under 0.1% and ramp volume gradually.
How long does a 5.7.28 block last?
Usually until your behavior changes. Once you cut volume, remove problem addresses and complaints fall, deliveries tend to recover over days to a few weeks. Sending harder makes it worse. The sender reputation guide explains how the signals recover. Patience is part of the fix.