ProbeKit
Sign inSign up

4.7.28 bounce: mail flood detected

4.7.28Mail flood detectedTemporary: the sender retries

Typical wording
421 4.7.28 Our system has detected an unusual rate of unsolicited mail originating from your IP address.

What it means

The IANA SMTP enhanced status code registry lists X.7.28 as “mail flood detected”: the receiver has seen an unusually high volume of mail, often of a kind its users mark as unwanted, from your IP address or domain, and is limiting it. It is a reputation and volume signal rather than a problem with one message.

The 4 class is the usual form, sent with 421 or 450. Gmail is the best-known user: its 421 4.7.28 deferrals say your IP or domain is sending an unusual rate of unsolicited mail. Your MTA keeps the messages queued and retries, and if the rate drops and complaints fall, they go through.

A 5.7.28 also exists for receivers that refuse outright, but it is rare. If deferrals continue for days, the queue lifetime runs out and the sender gets a final 4.4.7 expiry bounce, so a persistent 4.7.28 still loses mail.

Likely causes

  • A sudden spike in volume from a new IP or domain without warm-up.
  • A campaign to an old or purchased list, producing many spam complaints and unknown users.
  • A compromised account or web form sending spam through your server.
  • Missing authentication (SPF, DKIM, or DMARC), which makes the receiver judge the traffic more harshly.

How to fix it

  1. Check your outbound queue and logs for unexpected volume, and stop any compromised account or form first.
  2. Slow down: lower concurrency and messages per hour to the affected provider, and let the queue drain gradually.
  3. Clean the list. Remove bounced and inactive addresses and make sure every recipient opted in.
  4. Authenticate all mail with SPF, DKIM, and DMARC, and add a one-click List-Unsubscribe header to bulk mail.
  5. Watch spam rate and reputation in Google Postmaster Tools, and warm up new IPs over several weeks.

Checks that apply

  • Google/Yahoo Compliance Checks the Gmail and Yahoo bulk-sender rules (authentication, unsubscribe, spam rate guidance) whose breach often sits behind 4.7.28.
  • Blacklist Check Shows whether the same flood has already put your IP or domain on public blocklists.
  • Domain Health Confirms SPF, DKIM, and DMARC are in order, which improves how receivers rate your volume.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Will my mail still be delivered?
Often yes, because 4.7.28 is a deferral and your server retries. If the rate stays high the retries keep failing and the messages eventually expire.
How long does a 4.7.28 last?
It eases as your volume and complaint rate drop, often within hours to a few days. Reducing the rate is faster than waiting.

All 191 bounce codes