421: reverse DNS lookup failed
Xfinity could not complete a reverse DNS lookup for your sending IP. It treats this as temporary, so your server should retry, but a broken DNS setup keeps it failing.
- Comcast
- Provider
- Temporary (4xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 421
- Provider
- Comcast (Xfinity)
- Temporary or permanent
- TemporaryThe sending server keeps the message and tries again later.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
421 Reverse DNS failure : Try again later
What it means
Xfinity requires every sending IP address to have valid reverse DNS. When its lookup of your IP's PTR record fails with a SERVFAIL, it answers with this 421 and expects the sender to try again later. Xfinity notes that in nearly every case a SERVFAIL means a DNS server somewhere up the chain of authority is misconfigured, down or badly overloaded. Reverse DNS for an IP is served by whoever controls the address block, so the fix normally sits with the hosting provider or ISP. If the lookup instead finds that no PTR record exists, Xfinity sends a permanent 554 PTR lookup failure.
Common causes
- A DNS server responsible for the reverse zone of your IP is misconfigured.
- That DNS server was down or overloaded when Xfinity asked.
- The delegation of the reverse zone from your provider is broken.
How to fix it
- 01Let your server retry, since this reply is temporary.
- 02Look up the PTR record for your sending IP from more than one network and see whether it answers reliably.
- 03If it fails, ask the owner of the IP block, your host or ISP, to fix the reverse DNS servers or the delegation.
- 04Make sure the PTR name resolves forward to the same IP.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
Related codes
- 554No reverse DNS (PTR) record.Xfinity refused the connection because your sending IP has no PTR record. Every server sending to Xfinity needs valid reverse DNS, so the owner of the IP must add one.
- ES000010Dynamic or residential IP address.Xfinity blocked the connection because your server sends from IP space it considers dynamic or residential, in most cases because the reverse DNS name does not look static.
- 421Service not available.The receiving server is closing the connection and will not take mail right now. The reply is temporary, so the sending server keeps the message and tries again later.
421 at other providers
- 421 [RP-001]Outlook.com rate limit for the sending IP.Outlook.com is limiting how fast your IP can send to it because of the IP or domain's reputation; it is temporary and your server should retry.
- 421 [RP-002]Outlook.com rate limit on this connection.Your IP has sent more over a single connection than Outlook.com allows, a limit Microsoft ties to IP and domain reputation.
- 421 [RP-003]Outlook.com connection limit.Your IP has opened more connections to Outlook.com than it is allowed, a limit Microsoft links to IP and domain reputation.
- 421Temporary error or deferral.Yahoo or AOL refused your message for now with a 421, one of its two temporary error codes. Your server should keep it and retry; repeated deferrals point to reputation or complaints.
- 421Temporary reject under an exceptional blocklist.GMX refused the connection from your server for now under one of the blocklists it applies in exceptional situations. Your server will retry; GMX asks you to stop the misuse first, then contact it.
- 421Too much of your mail is spam.GMX is refusing mail from your server for a while because too large a share of its recent mail was classed as spam by the GMX filters.
Further reading
All 33 Comcast codesEvery code in the wikiPaste your own bounce