Gmail 421 4.7.30: rate limited, DKIM did not pass

What it means

This deferral is the DKIM half of Gmail’s bulk-sender rules. Gmail found no DKIM signature on the message, or found one that did not verify, and is slowing your traffic until it does. The example is the wording Google documents for it. Because the response is 421, your server retries.

A bulk sender can pass SPF and still get 4.7.30, because Google requires both mechanisms above the 5,000 per day threshold. DKIM is also what survives forwarding, so Gmail leans on it heavily. A signature that verifies but is for a domain other than the From domain will clear this code but may then trip 4.7.32 for alignment.

Likely causes

• Signing was never switched on in the platform that sends your newsletters or receipts.
• The selector’s public key was deleted, mistyped, or split across TXT strings incorrectly.
• Something after signing, such as a footer appender, link rewriter, or antivirus gateway, alters the body or signed headers.
• The key is too short: Gmail requires a DKIM key of 1024 bits or longer.

Checks that apply

• DKIM Check Fetches the selector record and reports key length and syntax problems.
• Email Header Analyzer Reads the DKIM-Signature and Authentication-Results lines to show why verification failed.
• Google/Yahoo Compliance Checks the full set of rules Gmail applies to bulk senders.

FAQ

I only send a few hundred emails a day. Does this apply?

The strict DKIM requirement targets bulk senders, but Gmail can throttle any sender whose mail lacks authentication, so signing is worth doing regardless.

Can I sign with my ESP’s domain instead of mine?

That clears the DKIM check, but bulk senders also need DMARC alignment, which means a signature for your own From domain.