421 4.7.0: TLS required by the recipient's domain
The Workspace domain you are writing to only accepts mail over an encrypted connection, and your server tried to deliver without TLS.
- Gmail
- Provider
- Temporary (4xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 421 4.7.0
- Provider
- Gmail and Google Workspace
- Temporary or permanent
- TemporaryThe sending server keeps the message and tries again later.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
421 4.7.0 TLS required for RCPT domain, closing connection.
What it means
Workspace admins can require that mail from some or all senders arrives over TLS. Your server connected without starting TLS, or could not complete the handshake, so Gmail closed the connection when it saw the recipient's domain in RCPT TO. The reply is temporary, but retries fail the same way until your server encrypts the connection. Google links it to its article on email encryption in transit. Most mail servers support STARTTLS, so this usually means it has been turned off, the server's TLS software is too old to agree on a protocol with Google, or a device in the path removes the STARTTLS offer.
Common causes
- The sending server has STARTTLS turned off or not configured.
- Old TLS software that cannot agree on a protocol version or cipher with Google.
- A firewall or SMTP inspection product that removes STARTTLS from the conversation.
How to fix it
- 01Turn on STARTTLS for outgoing mail on your server.
- 02Update the server's TLS libraries so it supports current protocol versions.
- 03Remove SMTP inspection or STARTTLS stripping from firewalls between your server and the internet.
- 04Send a test to a Gmail address and check that its Received header shows an encrypted (ESMTPS) hop.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Gmail SMTP errors and codes (Google Workspace Admin Help)knowledge.workspace.google.com
Related codes
- 421 4.7.29Not sent over TLS, rate limited.Gmail is rate limiting your mail because your server delivered it without TLS encryption, which Google's sender guidelines require.
- 530 5.7.0STARTTLS required first.Gmail requires your client to switch the connection to TLS with STARTTLS before it signs in or sends mail, and your client did not.
- 421Service not available.The receiving server is closing the connection and will not take mail right now. The reply is temporary, so the sending server keeps the message and tries again later.
- 5.7.0Security or policy refusal, unspecified.The message or session was refused for a security or policy reason that the server did not describe more precisely, or chose not to reveal.
Further reading
All 108 Gmail codesEvery code in the wikiPaste your own bounce