Throttling

Throttling is a traffic-control decision. A mailbox provider uses it when you are sending faster than it is willing to accept from you at that moment, so instead of taking every message it defers some of them. It does this with a temporary 421 reply, a transient 4xx response that means “not right now, try again later,” not “never.” Your mail server holds the deferred messages in its queue and retries them on a back-off schedule, which is why a throttled send usually still arrives, just more slowly.

The key thing to understand is that throttling is rarely a bug at your end. It is the receiver applying a policy, and the rate it is willing to accept is tied directly to how much it trusts you. A brand-new IP or domain with no track record gets a low ceiling; an established sender with a clean reputation gets a high one. That makes a sudden wave of 421 responses one of the most useful early-warning signals you have.

Throttling clusters around a few causes, and the response code often hints at which one you have hit:

• Volume spikes. A domain or IP that normally sends a few hundred messages a day suddenly firing tens of thousands in an hour looks exactly like a compromised account or a spam run. Legitimate high-volume senders ramp up gradually; sudden surges get deferred.
• Too many connections. Opening more simultaneous SMTP connections than the receiver allows triggers a connection-level limit, separate from message volume.
• Reputation concerns. If your complaint rate rises or your IP reputation slips, providers tighten the rate they accept from you as a protective measure, sometimes alongside spam-foldering.
• Missing authentication. Gmail now rate-limits unauthenticated bulk mail outright, returning a 421 until SPF, DKIM, and DMARC are in place.

A throttling reply carries an enhanced status code that points at the reason. Gmail and Yahoo are the most explicit:

• 421 4.7.0: a broad policy or reputation deferral. Yahoo’s [TSS04] variant specifically calls out unexpected volume.
• 421 4.7.26: Gmail’s code for mail that fails authentication, which it now rate-limits.
• 421 4.7.28: Gmail’s IP rate-limit code for an unusual volume of mail from your address.

All three sit in the 4xx range, so they are soft bounces, not hard failures. The danger is treating a steady stream of them as harmless noise: a rising rate of throttling replies from a single provider is a reputation problem to investigate, not a queue to push harder against.

The one rule that matters: slow down, do not speed up. Continuing to retry deferred mail at the same volume amplifies the throttle and can escalate it from a temporary 421 into a hard 5xx block that is far harder to recover from. The correct pattern is exponential backoff: widen the gap between retries each time a message is deferred, and reduce the rate at which you open new connections and send new mail to that provider.

Most of the cure is preventive. Warm up new IPs and domains by raising volume gradually so receivers can build trust before you push real numbers (see the IP warm-up and domain warm-up entries). Smooth large campaigns out over time instead of firing them all at once, keep your authentication and list hygiene tight, and when a provider does lift a limit, ramp back up gradually rather than jumping straight to full volume, which often just re-triggers the limit.