4.7.40

Enhanced Status Code 4.7.40: Rate Limited - DMARC Record Missing or Invalid

Temporary failure High severity Authentication RFC 7489
What it means

Enhanced Status Code 4.7.40 means “Rate Limited - DMARC Record Missing or Invalid.” Google is throttling your mail because the sending domain publishes no readable DMARC record. It is the grace period before 5.7.40 begins rejecting outright.

At a glance
Code4.7.40
Bounce typeSoft (temporary)
SeverityHigh
CategoryAuthentication
What to doQueued and retried automatically
StandardRFC 7489
What it looks like in your mail logs 
421 4.7.40 Email rate limited. The sending domain has a missing or invalid DMARC record or policy

What does 4.7.40 mean?

Google returns 4.7.40 with a 421 reply when it rate limits mail from a domain whose DMARC record is missing or invalid. It is the deferral form of 5.7.40, and it exists because Google chose to phase the February 2024 sender requirements in rather than switching them on as hard rejections.

That phasing is the reason this code deserves attention. A sender with no DMARC record does not stop delivering, they simply deliver more slowly, and nothing in a normal delivery report says why. The requirement is minimal: a single TXT record at _dmarc.yourdomain.com containing v=DMARC1 and a policy, where p=none is sufficient and changes nothing about how your mail is treated.

What usually fails is not the decision to publish but the publishing itself. The record must be at _dmarc rather than the apex, v=DMARC1 must be the first tag, and exactly one record must exist at that name. DNS editors that insert smart quotes or wrap long values introduce characters that make a visually correct record unparseable. Verify what actually resolves rather than trusting what you typed.

How 4.7.40 plays out

Your server attempts delivery
The recipient defers with a temporary 4.7.40 reply
Your server queues the message and retries on a back-off schedule
It delivers on a later attempt, or becomes a hard bounce if it keeps failing

Where 4.7.40 sits: soft vs hard bounce

Soft bounce (4xx) Hard bounce (5xx)
NatureTemporaryPermanent
SMTP class4xx5xx
What to doLet it retrySuppress the address
Recoverable?OftenNo
4.7.40 is✓ this code

What each provider means by 4.7.40

A registered code does not oblige a provider to use it that way, and the large ones diverge. Match the wording in your own bounce, not the definition above.

Gmail Email rate limited because the DMARC record or policy is missing or invalid Reference

Common causes of 4.7.40

  • No DMARC record has been published for the sending domain
  • The record was published at the apex rather than at _dmarc
  • v=DMARC1 is missing or is not the first tag in the record
  • Two DMARC records exist at _dmarc, leaving the policy indeterminate
  • A DNS editor introduced smart quotes or a line break into the value
  • A sending subdomain publishes its own broken record, overriding a valid apex policy

How to fix 4.7.40

  • Publish v=DMARC1; p=none; rua=mailto:[email protected] at _dmarc.yourdomain.com
  • Confirm the record resolves with DMARC Record Checker rather than trusting the DNS panel
  • Ensure exactly one DMARC record exists at that name
  • Check any subdomain you send from for its own conflicting record
  • Collect aggregate reports for several weeks before tightening beyond p=none
  • Watch queue latency rather than bounce rate, since this is a deferral

Frequently asked questions

What does 421 4.7.40 mean from Gmail?
It means Gmail is rate limiting your mail because your sending domain has no DMARC record, or has one it cannot parse. It is temporary, so messages retry and usually deliver, but throughput to Gmail is reduced until a valid record exists. It is the warning stage before the permanent 5.7.40 rejection.
Is p=none enough to clear this?
Yes. The requirement is that a valid DMARC record exists, not that it enforces anything. v=DMARC1; p=none; rua=mailto:[email protected] satisfies it completely and changes nothing about how receivers treat your mail. It also starts the aggregate reports flowing, which is what you need before considering quarantine or reject.
I published a record but the throttle continues. What is wrong?
Check what actually resolves rather than what you typed. The three usual faults are publishing at the apex instead of _dmarc, putting a tag before v=DMARC1, and having two records at the same name. A fourth is invisible: some DNS panels insert typographic quotes or wrap the value, which makes a record that looks perfect fail to parse.
How is 4.7.40 different from 4.7.26?
They fail at different stages. 4.7.26 means the authentication checks themselves failed. 4.7.40 means the receiver could not even find a policy telling it what to do about that. You can fail 4.7.40 with perfectly working SPF and DKIM, simply because no DMARC record is published.
Does this apply to me if I send low volume?
Google frames the requirement around bulk senders, but the throttle is applied by evaluation rather than by an announced threshold, and the cost of compliance is one DNS record. There is no case for a domain that sends business mail not publishing DMARC in 2026, and no downside to p=none.

Related bounce codes

5.7.40 DMARC Record Missing or Invalid 4.7.32 Rate Limited - From Header Not Aligned 5.7.26 DMARC Authentication Failed 5.7.32 From Header Not Aligned with SPF or DKIM 4.7.26 Multiple Authentication Checks Failed - Temporary

Sources & further reading

RFC 7489 · The standard that defines this reply code Gmail SMTP errors and codes · Google Workspace reference for every code Gmail returns Google email sender guidelines · The February 2024 authentication requirements for bulk senders
Reviewed by Jennifer Jackson, Email Deliverability Analyst · June 2026 ← All bounce codes