Why does Gmail block my email with 550 5.7.29 or 421 4.7.29?

Gmail slowed down or blocked the message because the server that sent it did not encrypt its connection to Gmail with TLS. Whoever runs that server turns on TLS for outgoing mail. This bounce is not about SPF, DKIM or DMARC, and no DNS record of yours fixes it.

The bounce

Google's list of Gmail SMTP errors gives the text under 550 5.7.29:

This message was blocked because it wasn't sent over a TLS connection. Gmail requires all bulk email senders to use TLS/SSL for SMTP connections.
To set up TLS for email, visit TLS & SSL connections. To learn more about Gmail requirements for bulk email senders, visit Email sender guidelines.

Under 421 4.7.29, the temporary form:

Your email has been rate limited because you're not using a TLS connection. Gmail requires all bulk email senders to use TLS/SSL for SMTP connections.
To set up TLS for email, visit TLS & SSL connections. To learn more about Gmail requirements for bulk email senders, visit Email sender guidelines.

What Gmail checked

Gmail checked whether the server that connected to it encrypted the connection with TLS. It had not. The bounce speaks of bulk senders, but Google's sender guidelines list "Use a TLS connection for transmitting email." among the "Requirements for all senders". So it applies whatever your volume.

Who has to fix it

Whoever runs the server that sent the message. That can be your email provider, a sending service or your web host. It can also be a server or device of your own, such as an office mail server, a scanner or a website that sends mail by itself.

• A service sent it. Send the bounce text to its support, with the time and the address you sent to.
• Your own server or device sent it. Turn on TLS for outgoing mail in its settings. The setting is often called STARTTLS. If the device cannot use TLS, have it send through your email provider's server with a login instead.

Check whether a sender uses TLS

Send a message from the service or server to a Gmail address you can read. Google's page on checking email security describes the steps. In short:

1. In Gmail, open the message.
2. Open Show details, at the top next to the recipient.
3. Read the encryption type next to security.

"Standard encryption (TLS)" means the connection was encrypted. "No encryption supported" means it was not. Google adds: "If a sender’s email provider doesn’t support TLS, the email may not be encrypted."

The records

None. TLS on outgoing mail is a setting of the sending server. The DNS records that deal with TLS, MTA-STS and TLS-RPT, cover mail that other servers send to your domain, not mail you send.

What it looks like in your DMARC reports

It does not show. An aggregate report row holds the sending address, a message count and the DMARC, SPF and DKIM results (RFC 9990, sections 3.1.1.7 to 3.1.1.11), and nothing about encryption. Mail sent without TLS can pass DMARC. TLS reports do report encryption, but for mail sent to your domain.

Mailmoni reads both the DMARC reports about mail sent as your domain and the TLS reports about mail sent to it.