Gmail 421 4.7.29: rate limited, no TLS connection
421 4.7.29Rate limited because the connection did not use TLSTemporary: the sender retriesFrom Gmail and Google Workspace
421 4.7.29 Your email has been rate limited because you're not using a TLS connection. Gmail requires all bulk email senders to use TLS/SSL for SMTP connections.
What it means
Google’s bulk-sender rules include a transport requirement: the SMTP session that hands mail to Gmail must be encrypted with TLS. When your server skips STARTTLS, Gmail throttles the traffic with 4.7.29, worded as in the example Google documents. Retries continue, but every unencrypted attempt meets the same throttle.
Unlike the 4.7.0 TLS text, which comes from a single Workspace customer’s policy, this one is Gmail-wide. The error text names bulk senders, but Google’s sender guidelines list a TLS connection as a requirement for all senders. Gmail has advertised STARTTLS for years, so in practice the fault is almost always a sender configuration or an old library.
Likely causes
- Outbound TLS disabled in the MTA (for example Postfix `smtp_tls_security_level = none`).
- An application talks directly to Gmail MX hosts through a library that never calls STARTTLS.
- A TLS handshake error, such as an obsolete protocol version or cipher list, makes the MTA fall back to plain text.
How to fix it
- Turn on opportunistic TLS for outbound mail: `smtp_tls_security_level = may` in Postfix, or the equivalent in Exim or your appliance.
- Check logs for lines like “TLS handshake failed” toward gmail-smtp-in.l.google.com and update OpenSSL if needed.
- If an application delivers directly, route it through your MTA or an ESP that uses TLS instead.
- Confirm in a delivered message that the Received header from Google mentions a TLS version, then release the queue.
Checks that apply
- Google/Yahoo Compliance Includes Gmail’s TLS requirement in its list of bulk-sender checks.
- Email Header Analyzer Shows whether the Received line Gmail added records an encrypted hop.
- TLS-RPT Check Checks TLS reporting so you receive reports when mail to your own domain fails to negotiate TLS.
FAQ
- Does TLS need a valid certificate on my sending server?
- Not for this check. Gmail cares that the session is encrypted; your client side does not present a certificate.
- Is TLS 1.0 acceptable?
- You should not rely on it. Use TLS 1.2 or 1.3 so handshakes with Google succeed.
Sources:Gmail SMTP errors and codes (Google Workspace Admin Help)Email sender guidelines (Gmail Help)Checked 2026-10-18