Gmail 421 4.7.27: rate limited, SPF did not pass

What it means

Code 4.7.27 belongs to the authentication codes Google introduced with its 2024 sender requirements. It singles out SPF: the envelope sender (Return-Path) domain did not produce an SPF pass for the connecting IP. Gmail responds with a temporary throttle rather than an immediate rejection, and the example is the wording Google documents for it.

Bulk senders, which Google defines as anyone sending more than 5,000 messages a day to Gmail accounts, must set up SPF and DKIM both. A sender with a valid DKIM signature can still meet this code if SPF is broken. The permanent sibling is 5.7.27, and a total lack of authentication produces 5.7.26 instead.

Likely causes

• The envelope domain has no SPF record at all.
• The sending IP or ESP include is missing from the record, so the result is fail or softfail.
• The record breaks the 10 lookup limit or has a syntax error, giving permerror.
• Two separate v=spf1 TXT records exist on the same name, which also produces permerror.

Checks that apply

• SPF Check Parses the record, counts DNS lookups, and tests whether a given IP is permitted.
• SPF Generator Builds a clean single record from your list of senders when the existing one is a mess.
• Google/Yahoo Compliance Checks every bulk-sender requirement, so you fix SPF without missing DKIM or DMARC.

FAQ

Does a softfail (~all) count as a pass?

No. Only an explicit pass for the sending IP satisfies this check. Softfail and neutral are treated as not passing.

Will the queued messages deliver after I fix SPF?

Yes, if they are still in your retry queue. Gmail evaluates SPF fresh on each attempt.