Summary
Many Microsoft 365 users are experiencing email rate limiting from Gmail, often indicated by the error message "421-4.7.28 Our system has detected an unusual rate of unsolicited mail originating from your IP address." This issue can lead to significant delivery delays and failures, despite senders often maintaining low email volumes. The core problem frequently ties back to sender reputation and authentication, particularly the configuration of DKIM (DomainKeys Identified Mail).
Key findings
- Authentication issues: A primary cause of Gmail rate limiting for M365 emails is often related to improper or missing DKIM authentication for the sender's own domain.
- Shared infrastructure impact: Microsoft 365 uses shared IP addresses, meaning the sending habits of other users on the same infrastructure can negatively affect your individual sender reputation.
- Default DKIM domains: Relying on the default "onmicrosoft.com" DKIM domain, or only on SPF (Sender Policy Framework) for authentication, may not be sufficient for Gmail's stricter requirements.
- IPv6 sensitivity: Gmail is particularly rigorous about inbound mail over IPv6, which is often used by Office 365, making proper authentication even more crucial.
- Increased scrutiny: Both Google and Microsoft are implementing new, stricter bulk email sender requirements to combat spam, which can impact even low-volume senders if they are not fully compliant.
Key considerations
- Implement custom DKIM: Ensure DKIM is properly configured for your own sending domain, rather than relying on Microsoft's default shared domain.
- Review SPF records: Verify your SPF record is correctly set up to authorize Microsoft 365 as a legitimate sender for your domain. Learn more about DMARC, SPF, and DKIM.
- Monitor deliverability: Keep a close eye on bounce messages and monitor your email delivery to Gmail to quickly identify and address any rate limiting issues.
- Comply with guidelines: Ensure your sending practices align with Gmail's sender requirements, including maintaining low spam complaint rates and easy unsubscribe options.
What email marketers say
Email marketers frequently encounter frustrating rate limiting and email blocking when sending from Microsoft 365 accounts to Gmail recipients. These issues often appear suddenly, despite consistent sending practices and low volumes. Discussions in online communities highlight a shared experience among users, pointing towards potential systemic issues between the two platforms, or specific authentication configurations that inadvertently trigger Gmail's spam filters and rate limits.
Key opinions
- Widespread problem: Many marketers and IT administrators report seeing similar 421-4.7.28 rate limiting errors specifically for emails sent from M365 to Gmail.
- Authentication confusion: There's a common belief that while Microsoft manages some backend configurations, the ultimate responsibility for proper domain authentication (like DKIM) falls to the sender.
- Not a personal issue: Many feel it's less about their specific sending volume or content and more about a broader issue related to Microsoft's shared IP reputation or how Gmail perceives M365 traffic.
- Impact of shared infrastructure: The collective sending behavior of all M365 users can affect the deliverability of even legitimate emails, leading to unexpected blocklisting or rate limits.
Key considerations
- Check community forums: Engage with communities and forums, as others may be experiencing similar Microsoft 365 to Gmail deliverability issues and can offer shared solutions.
- Review bounce messages: Carefully analyze the reason codes in bounce messages, such as the "421-4.7.28" error, to pinpoint the exact nature of the rate limit.
- Prioritize DKIM setup: If you're using M365, ensuring that DKIM is signed with your own domain is a critical step to improving deliverability to Gmail and Microsoft domains.
- Check email authentication status: Regularly verify your SPF and DKIM records are correctly published and aligned with your sending domain to avoid issues like common DMARC issues in M365 and Google Workspace.
Marketer view
Marketer from Email Geeks shared a client's experience of getting bounce backs from Gmail addresses indicating rate limiting due to unsolicited mail, even with small email counts from a Microsoft 365 account. This suggests a potential larger issue between the two companies.
Marketer view
Marketer from Reddit reported that many M365 tenants have been unable to send to Gmail recipients, with Google servers rejecting connections due to rate limits. This confirms that it's a widely observed problem.
What the experts say
Email deliverability experts concur that the rate limiting of Microsoft 365 emails by Gmail is a critical symptom of underlying authentication and reputation challenges. They emphasize that while M365 provides email services, senders must take proactive steps to ensure their own domain's reputation and proper email authentication are meticulously managed, especially when sending to services with stringent anti-spam policies like Gmail.
Key opinions
- DKIM is paramount: Experts strongly recommend implementing DKIM with your own custom domain (d=yourdomain.com) when sending from M365, as shared default domains often have poor reputations with Gmail.
- SPF-only isn't enough: Relying solely on SPF for authentication, without DKIM, can lead to deliverability issues, particularly with Gmail, which values strong domain alignment.
- IPv6 scrutiny: Gmail applies extra scrutiny to email traffic over IPv6, a protocol often used by Office 365, making a robust authentication setup even more vital.
- Shared reputation risks: The poor reputation of shared IP addresses used by Office 365 due to other senders' bad practices can directly cause rate limiting for legitimate users.
- Source of spam: A significant volume of spam originates from Office 365, leading to stricter filtering by major mailbox providers like Gmail.
Key considerations
- Proper authentication: Ensure your email is properly authenticated with your own domain, especially setting up DKIM, to improve deliverability from M365 to Gmail.
- Understand Gmail's grouping: Recognize that Gmail can group sender reputations based on the SPF domain or SPF hostname, particularly when DKIM is absent, leading to widespread impact from a single bad actor. This can lead to temporary rate limiting due to IP reputation.
- Active monitoring: Continuously monitor your sender reputation and deliverability, as issues can arise even with seemingly small sending volumes.
- Address DKIM temporary errors: If you encounter DKIM-related issues, investigate and resolve them promptly, as these can contribute to throttling by Microsoft and other providers, as discussed in diagnosing and reducing DKIM temporary error rates with Microsoft.
Expert view
Expert from Email Geeks suggests that a DKIM issue is a very likely cause for Gmail hating an IP, as Gmail sometimes attributes IP problems to mail associated with the DKIM or SPF domain. Implementing DKIM for your own domain, rather than the default onmicrosoft.com, often resolves such issues.
Expert view
Expert from Word To The Wise states that a common pitfall for senders using shared hosting or cloud services is poor reputation attached to the default shared authentication domains. This makes it crucial for senders to configure their own domain for DKIM signing to ensure better deliverability.
What the documentation says
Official documentation and industry analysis from major email service providers and security blogs confirm a tightening of email sending policies. Both Google and Microsoft are actively implementing stricter measures to combat spam and enhance security, including new bulk email sender guidelines and internal rate limits. This means that email authentication protocols (SPF, DKIM, DMARC) and sender reputation are more crucial than ever for successful deliverability.
Key findings
- Microsoft's new limits: Microsoft has introduced a new Tenant External Recipient Rate Limit (TERRL) of 2,000 recipients in 24 hours for M365 Exchange Online, specifically to fight spam.
- Google's bulk sender requirements: Gmail has updated its requirements for bulk senders, mandating strong authentication (SPF, DKIM, DMARC), low spam rates, and easy one-click unsubscribe options.
- Recipient rate limits: Exchange Online employs recipient rate limits to manage the volume of traffic from individual mailboxes and prevent abuse.
- IP reputation as a factor: Google's and Microsoft's systems detect "unusual rates of unsolicited mail" originating from IP addresses, indicating that IP reputation is a direct trigger for rate limiting.
- Authentication as a protective measure: Robust authentication (SPF, DKIM, DMARC) is highlighted as critical for compliance and to protect users from spam, as non-compliance can lead to temporary rate limiting.
Key considerations
- Adhere to new sender requirements: Ensure full compliance with the latest bulk email restrictions from Google and Microsoft to avoid throttling or blocks.
- Understand Microsoft's internal limits: Be aware of Microsoft's own sending limits, such as the Tenant External Recipient Rate Limit (TERRL), and how they apply to your M365 usage. Refer to our guide on why Microsoft rate limits email sends.
- Maintain strong sender reputation: Proactively manage your domain reputation by minimizing spam complaints and ensuring recipient engagement to prevent being perceived as a source of unsolicited mail. This is key to understanding your email domain reputation.
- Implement DMARC: For bulk senders, DMARC (Domain-based Message Authentication, Reporting & Conformance) is now often a mandatory requirement, providing an extra layer of protection and visibility into authentication failures.
Technical article
Documentation from BleepingComputer reports that Microsoft plans to impose a daily Exchange Online bulk email limit of 2,000 external recipients. This measure aims to fight spam and indicates a stricter stance on outbound email volumes from M365.
Technical article
Documentation from Retarus Corporate Blog highlights that Microsoft is introducing a new tenant-level outbound email limit, the Tenant External Recipient Rate Limit (TERRL), for Microsoft 365. This change targets high-volume external traffic to enhance spam protection.
Related resources
10 resources
Related pages
How to resolve slow email delivery to Gmail?
Why is my email getting throttled by Gmail and Microsoft despite high engagement and good reputation?
What causes temporary rate limiting due to IP reputation with Microsoft email servers?
What does 'rate limit exceeded' mean in email delivery, and how do I troubleshoot it?
A simple guide to DMARC, SPF, and DKIM
Diagnosing and reducing DKIM temporary error rates with Microsoft
How to fix common DMARC issues in Microsoft 365 and Google Workspace
Why your emails fail: expert guide to improve email deliverability [2025]
How to comply with outlook's new sender requirements
Why is Microsoft rate limiting email sends for some customers?
