Why does Gmail rate limit my email with 421 4.7.32?

Gmail slowed down or blocked the message because SPF or DKIM passed, but for another domain than the one in the From address. Gmail asks large senders for that alignment. The fix is in the sending service. It has to sign your mail with your domain or use a bounce address of yours, and you publish the records it gives you.

The bounce

Google's list of Gmail SMTP errors gives the text under 421 4.7.32:

Your email has been rate limited because the From: header (RFC5322) in this message isn't aligned with either the authenticated SPF or DKIM organizational domain.

A second row, 5.7.32, has the same text with "Your email was blocked" in place of "Your email has been rate limited". Google's table lists it with the reply code 421 too.

The first digit says how final it is (RFC 3463). 4.7.32 is temporary: "If this code accompanies a delivery failure report, sending in the future may be successful." 5.7.32 is permanent: "Some change to the message or the destination must be made for successful delivery." Either way, a later try meets the same check until the service is set up.

What Gmail checked

Gmail's sender guidelines ask senders who send more than 5,000 messages per day to Gmail accounts for the alignment that DMARC checks: "For direct email, the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain. This is required to pass DMARC alignment."

Google's Set up DMARC page defines the match. For DKIM, with the default relaxed alignment: "The domain in the header From: address must match or be a subdomain of the domain specified in the DKIM signature d= tag." For SPF, the From domain must match or be a subdomain of "the domain in the Envelope-Sender (also called Return-Path or bounce) address."

So the message passed SPF for the service's own bounce domain, and passed DKIM with the service's own signature. Both are real passes, and neither is your domain.

Who has to fix it

You, in the settings of the service that sent the mail. Services call the setting custom DKIM, an authenticated domain, domain authentication or a custom domain. Turn it on for your domain, and publish the records the service gives you. Many services also let you use a bounce address under your domain, which makes SPF align too.

If the service offers neither, mail it sends in your name cannot align with your domain. Ask its support for custom DKIM, or send that mail through a service that has it. If you send from your own mail server, sign with DKIM for your domain there.

The reports of the next day or two show whether the fix worked. One aligned check is enough: when DKIM or SPF aligns for the service's mail, it passes DMARC and meets Gmail's rule.

The records

For example.com and a newsletter service, the DKIM record usually looks like one of these, under the selector the service names:

s1._domainkey.example.com  CNAME  s1.dkim.newsletter.example
s1._domainkey.example.com  TXT    v=DKIM1; k=rsa; p=MIIBIjANBgkqh...

A CNAME points to a key the service keeps and rotates. A TXT record holds the key itself. The service tells you which one, with the exact name and value. A custom bounce address is usually a subdomain, such as bounces.example.com, with records the service also gives you. Set up DKIM for a sending service has the steps, and Use your own bounce domain too the second part.

What it looks like in your DMARC reports

In the aggregate reports for your domain, the service behind this bounce shows up as a row like this:

<row>
  <source_ip>192.0.2.10</source_ip>
  <count>40</count>
  <policy_evaluated>
    <disposition>none</disposition>
    <dkim>fail</dkim>
    <spf>fail</spf>
  </policy_evaluated>
</row>
<identifiers>
  <header_from>example.com</header_from>
</identifiers>
<auth_results>
  <dkim>
    <domain>newsletter.example</domain>
    <selector>s1</selector>
    <result>pass</result>
  </dkim>
  <spf>
    <domain>bounces.newsletter.example</domain>
    <result>pass</result>
  </spf>
</auth_results>

auth_results shows both checks passing, for newsletter.example. policy_evaluated shows both failing, because those are "The result of the DKIM DMARC Identifier Alignment test" and the same for SPF (RFC 9990, section 3.1.1.9). Microsoft's DMARC guide calls pass with alignment fail the "classic alignment problem".

In Mailmoni, the Sources page shows that each check passed for another domain, and when we recognise the service, its explanation tells you to turn on custom DKIM and a custom bounce domain in it.