Gmail and Google Workspace · permanent error
550 5.7.29: not sent over TLS, blocked
Gmail rejected the message because your server delivered it without TLS encryption, which Google's sender guidelines require.
- Gmail
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550 5.7.29
- Provider
- Gmail and Google Workspace
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
550 5.7.29 This message was blocked because it wasn't sent over a TLS connection.
What it means
This is the permanent form of 421 4.7.29. Google's sender guidelines require a TLS connection for mail sent to Gmail, and this message arrived over an unencrypted one, so Gmail rejected it. Google lists the code in its sender guidelines FAQ. The fix is on the sending server: turn on STARTTLS, keep its TLS libraries current, and make sure nothing between the server and the internet strips the STARTTLS offer. Then send the message again.
Common causes
- STARTTLS is turned off for outgoing mail on the sending server.
- TLS software too old to complete a handshake with Gmail.
- A firewall or appliance that removes STARTTLS from the conversation.
How to fix it
- 01Turn on STARTTLS for outgoing mail on your server.
- 02Update the server's TLS libraries.
- 03Remove any SMTP inspection that strips STARTTLS.
- 04Resend once a test message to Gmail shows an encrypted (ESMTPS) hop in its Received header.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Gmail SMTP errors and codes (Google Workspace Admin Help)knowledge.workspace.google.com
- Email sender guidelines FAQ (Gmail Help)support.google.com
- Email sender guidelines (Gmail Help)support.google.com
Related codes
- 421 4.7.29Not sent over TLS, rate limited.Gmail is rate limiting your mail because your server delivered it without TLS encryption, which Google's sender guidelines require.
- 421 4.7.0TLS required by the recipient's domain.The Workspace domain you are writing to only accepts mail over an encrypted connection, and your server tried to deliver without TLS.
- 550Mailbox unavailable.The receiving server permanently refused the message for this recipient: the mailbox does not exist, cannot be reached, or the server rejected the message by policy.
Further reading
All 108 Gmail codesEvery code in the wikiPaste your own bounce