SMTP 421 4.7.0: temporarily rate limited, try again later

What the message looks like

421-4.7.0 [203.0.113.10] Our system has detected an unusual rate of unsolicited mail originating from your IP address.

Common causes

• A sudden spike in volume, e.g. a newsletter from a new IP without reputation.
• Missing or mismatched PTR (reverse DNS) record; Gmail is especially strict for IPv6.
• Spam complaints, or a compromised mailbox sending spam.
• Missing SPF/DKIM authentication makes the rating worse.

Check

1. Check the queue size
   mailq | tail -n 1Copy
2. Find the senders with the most mails in the queue
   mailq | awk '/^[0-9A-F]/ {print $7}' | sort | uniq -c | sort -rn | headCopy
3. Check the PTR of the outgoing IP
   dig -x 203.0.113.10 +shortCopy
4. Count 421 deferrals in the log
   journalctl -u postfix --since today | grep 'status=deferred' | grep -c ' 421'Copy

Fix

• Let Postfix handle retries – do not run postqueue -f over and over, it makes throttling worse.
• Set a PTR that matches the HELO name and make that name resolve back to the IP (forward-confirmed rDNS).
• Lock compromised accounts, reset passwords and remove spam with postsuper -d <QueueID>.
• Slow down delivery to large providers, e.g. with a dedicated transport and smtp_destination_rate_delay or a lower smtp_destination_concurrency_limit.
• Warm up new IPs gradually and watch reputation in Google Postmaster Tools.

FAQ

Are messages lost on a 421?

No. 4xx is a temporary error. Postfix keeps the mails in the queue and retries until maximal_queue_lifetime (5 days by default).

Why does it only happen over IPv6?

Gmail requires a valid PTR and authentication for IPv6 senders. Without a PTR, either add one or make Postfix prefer IPv4 with smtp_address_preference = ipv4.