Gmail 421 4.7.0: TLS required for RCPT domain
421 4.7.0TLS required for the recipient domainTemporary: the sender retriesFrom Gmail and Google Workspace
421 4.7.0 TLS required for RCPT domain, closing connection. - gsmtp
What it means
Google Workspace admins can enforce secure transport for mail from particular domains or to their own users. When your server connects to Gmail without starting TLS and the recipient domain demands it, Google answers with this deferral, usually worded like the example, and drops the session. The 421 code asks you to retry, but retrying in plain text will fail every time.
This is a transport policy result, not a judgment on your content or reputation. It also differs from 4.7.29, which affects bulk senders to personal Gmail who skip TLS. Here the rule comes from a specific Workspace customer’s compliance settings.
Likely causes
- Your MTA has STARTTLS turned off for outbound mail, or only tries TLS opportunistically and gave up after a handshake error.
- An outdated TLS library on your server cannot negotiate any protocol version Google still accepts (TLS 1.2 or later).
- A firewall or security appliance strips the STARTTLS keyword from the SMTP session.
- The recipient organisation configured a TLS compliance rule that names your domain.
How to fix it
- Enable outbound opportunistic TLS. In Postfix set `smtp_tls_security_level = may`; in Exim, make sure the remote_smtp transport has TLS enabled.
- Upgrade OpenSSL or your mail software if logs show handshake failures with Google.
- Disable any SMTP inspection feature on your firewall that removes STARTTLS from the EHLO reply.
- Flush the queue after the change so deferred messages are retried over TLS.
Checks that apply
- SMTP Diagnostics Connects to a mail server to confirm STARTTLS is offered and the certificate is valid, which helps when checking your own relay.
- MTA-STS Check Shows whether the recipient domain publishes an MTA-STS policy demanding TLS for all inbound mail.
FAQ
- Who needs to fix this?
- The sending side. The recipient’s TLS requirement is deliberate, so your server must use TLS when talking to Google.
- Do I need a certificate on my own server to send with TLS?
- Not for outbound STARTTLS as a client. You need a working TLS library; a certificate matters for mail you receive.