Enhanced Status Code 4.7.28: Mail Flood Detected - Temporary Rate Limit
Enhanced Status Code 4.7.28 means “Mail Flood Detected - Temporary Rate Limit.” The receiver has decided your traffic looks like a flood and is throttling it. This is the code Gmail returns most often when it rate limits a sender, and it is a reputation signal rather than a capacity one.
421 4.7.28 Our system has detected an unusual rate of unsolicited mail originating from your IP address. To protect our users from spam, mail sent from your IP address has been temporarily rate limitedWhat does 4.7.28 mean?
Enhanced status code 4.7.28 is registered for a message that appears to be part of a flood of similar abusive messages. Google returns it more than any other rate limiting code, across at least eight distinct message texts covering unusual volume from an IP address, from an IP netblock, from a DKIM domain, from an SPF domain, from a URL domain in the message body, and from a sender exceeding its Message-ID quota.
The important thing to understand is what is being rate limited. Google names the dimension in the text: if it says the DKIM domain, throttling follows your signing domain wherever it sends from, and moving to fresh IP addresses will not help. If it names the netblock rather than the address, a neighbour on shared hosting is affecting you. If it names a URL domain, the link target in your content is the problem rather than your infrastructure at all. Reading which dimension is named is the whole diagnosis.
Because it is temporary, a well-behaved MTA will back off and eventually deliver. That masks the real signal. A sustained 4.7.28 rate means the receiver has formed a negative opinion and is holding you at arm's length, and it typically precedes a permanent 5.7.28 by days. Treat a rising 4.7.28 share as the earliest actionable warning you get.
How 4.7.28 plays out
4.7.28 replyWhere 4.7.28 sits: soft vs hard bounce
| Soft bounce (4xx) | Hard bounce (5xx) | |
|---|---|---|
| Nature | Temporary | Permanent |
| SMTP class | 4xx | 5xx |
| What to do | Let it retry | Suppress the address |
| Recoverable? | Often | No |
| 4.7.28 is | ✓ this code |
What each provider means by 4.7.28
A registered code does not oblige a provider to use it that way, and the large ones diverge. Match the wording in your own bounce, not the definition above.
Common causes of 4.7.28
- Sending volume rose faster than the receiver expects from your IP or domain
- Recipient complaints or spam-folder placement have pushed reputation down
- A shared IP netblock is being throttled because of a neighbouring sender
- A URL domain used in your message body carries poor reputation of its own
- Messages were sent with duplicate or malformed Message-ID headers
- A new IP address is sending at volume before any sending history exists
How to fix 4.7.28
- Read the deferral text and note which dimension it names: IP, netblock, DKIM domain, SPF domain, or URL
- Reduce volume to the affected provider immediately and resume gradually
- Check IP and domain reputation with Sender Reputation Checker and Google Postmaster Tools
- If a URL domain is named, audit the link targets and any redirect or shortener service
- Confirm every message carries a unique, well-formed Message-ID
- Warm new IP addresses over two to four weeks rather than sending at full volume