Why does Gmail block my email with 550 5.7.28 or 421 4.7.28?

Gmail slowed down or blocked the message because it saw an unusual rate of unwanted mail from where the message came from: its sending address, its network, its DKIM or SPF domain, or the links in it. This bounce is not about SPF, DKIM or DMARC. Whoever runs the sending server or service looks into it, and if the mail is your own, you lower the share of it that recipients mark as spam.

The bounce

Google's list of Gmail SMTP errors has one text under 550 5.7.28:

There is an unusual rate of unsolicited email originating from your IP address. To protect our users from spam, email sent from your IP address has been blocked. To review our bulk email senders guidelines, go to Email sender guidelines.

Under 421 4.7.28, the temporary form, it has eight. Each one names what Gmail counted. These are their first two sentences:

Gmail has detected an unusual rate of email. To protect our users from spam, email has been temporarily rate limited.
Gmail has detected an unusual rate of email originating from your IP address ip-address. To protect our users from spam, email sent from your IP address has been temporarily rate limited.
Gmail has detected an unusual rate of unsolicited email originating from your IP Netblock ip-address. To protect our users from spam, email sent from your IP Netblock has been temporarily rate limited.
Gmail has detected an unusual rate of unsolicited email originating from your DKIM domain domain-name. To protect our users from spam, email sent from your domain has been temporarily rate limited.
Gmail has detected an unusual rate of unsolicited email originating from your SPF domain domain-name. To protect our users from spam, email sent from your domain has been temporarily rate limited.
Gmail has detected an unusual rate of unsolicited email containing one of your URL domains. To protect our users from spam, email with the URL has been temporarily rate limited.
Gmail has detected an unusual amount of unsolicited email originating from your IP address. To protect our users from spam, email sent from your IP address has been temporarily blocked.
Gmail has detected this sender exceeded the quota for sending messages that have the same Message-ID:. To best protect our users, the message has been temporarily rejected.

What Gmail checked

Gmail measures how much of the mail from that address, network, domain or link domain its users do not want. Google's sender guidelines FAQ says: "Spam rate is calculated daily. To help ensure messages are delivered as expected, senders should keep their spam rate below 0.1% and should prevent spam rates from ever reaching 0.3% or higher". The sender guidelines ask every sender, whatever the volume, to "Keep spam rates reported in Postmaster Tools below 0.3%."

Volume counts as well. The sender guidelines say: "When you exceed your quota, Gmail typically rejects messages with SMTP error code 4.7.28." They also say that on a shared sending address, "The activity of any senders using a shared IP address affects the reputation of all senders for that shared IP address."

Who has to fix it

The bounce text tells you where to look.

An IP address or netblock, on a shared server. Your email provider's, sending service's or web host's server sends mail for many customers, and their mail counts too. Send the bounce to the service's support: they run the server.
An IP address, on a server you run. Google's sender guidelines give the steps for a 4.7.28: "Do not send email for at least 10 minutes." Then: "Identify the cause." "If the error message does not specify if you exceeded your DKIM, SPF, or IP quota, assume that all three are affected." "After 10 minutes, send emails from a single connection." "If the single connection fails, wait another 10 minutes." "If successful, increase the number of connections one at a time until your desired number of connections are established."
Your DKIM or SPF domain. The complaints are about your own mail. Send it only to people who asked for it, and make leaving the list easy. The FAQ advises: "To reduce high spam rates, consider giving users an easy way to unsubscribe from marketing and promotional messages, and keep the user in mind when designing your emails."
Your URL domains. A domain that the links in your mail point to also appears in unwanted mail. Check every link in the message, including any tracking links the sending service adds.
The same Message-ID. The software that sends the mail gives many messages the same Message-ID. Whoever runs it fixes it so that each message gets its own.

Check your spam rate in Postmaster Tools

Google's Postmaster Tools page says: "Use Postmaster Tools to monitor information about outgoing email that you send to personal Gmail accounts". Its dashboards show spam rate, reputation, message authentication and delivery errors. To add your domain:

Sign in to Postmaster Tools.
On the "Manage Domains" page, click Add new domain.
Enter "the domain you use to authenticate outgoing email with SPF, or DKIM, or both", and click Create. Google adds: "Add either the DKIM (d=) domain or the SPF (Return-Path) domain."
Verify the domain: copy the TXT or CNAME record from the "Verify ownership of domain" window to your DNS, then click Verify.

"Data in Postmaster Tools only applies to messages sent to personal Gmail accounts." Mail to company mailboxes on Google Workspace is not in it.

The records

No change to SPF, DKIM or DMARC clears this bounce. The one record it involves is Postmaster Tools' own verification record, which you copy from the window in step 4. Add the domain your mail is signed with. If a service signs your mail with its own domain, turn on custom DKIM in it first, so that the mail carries your domain.

What it looks like in your DMARC reports

Aggregate reports do not show this bounce. A report row holds the sending address, a message count and the DMARC, SPF and DKIM results (RFC 9990, sections 3.1.1.7 to 3.1.1.11), and no spam complaints. If the mail passes DMARC, its rows look normal although Gmail blocked it. A sudden jump in count for one sending address can match a volume spike that Gmail slowed down.

Mailmoni shows each source's DMARC result on its Sources page, which rules authentication in or out before you look at spam rate.