Gmail 421 4.7.32: From header not aligned

What it means

Authentication passed, but for the wrong domain. Gmail compared the organizational domain of the visible From address with the domains that passed SPF and DKIM and found no match. This is DMARC alignment, which Google requires of bulk senders even when the domain’s DMARC policy is only p=none. The example is the wording Google documents for it.

It is a temporary rate limit, so mail is retried, but the condition will not change on its own. The permanent sibling is 550 5.7.32, which blocks the message outright for the same misalignment, and it differs from the DMARC variant of 5.7.26, which happens when the From domain itself publishes p=reject.

Likely causes

• An ESP signs with its own domain (d=esp.example.net) and uses its own Return-Path, while From shows example.com.
• Mail is sent with a From address on a domain you do not control, such as a free mailbox address, through your own server.
• A subdomain is used in From while signatures use an unrelated domain rather than the parent.

Checks that apply

• Email Header Analyzer Shows the From, Return-Path, and DKIM domains side by side so the misalignment is obvious.
• DMARC Check Confirms a DMARC record exists and whether alignment mode is relaxed or strict.
• DKIM Check Verifies the selector under your own domain that the ESP should sign with.

FAQ

Does relaxed alignment allow subdomains?

Yes. With the default adkim=r, a signature from mail.example.com aligns with a From of example.com.

Can I send as a gmail.com address through my own server?

No. You can never align with gmail.com, so such mail fails DMARC. Use an address on your own domain.