Skip to content
Proofpoint · temporary error

421: throttled by Proofpoint for unusual sending

Proofpoint is slowing down mail from your IP because its sending pattern looks unusual or unexpected. Your server should retry, and the delay often clears on its own.

Proofpoint
Provider
Temporary (4xx)
Class
Sources checked
Author

At a glance

Code
421
Provider
Proofpoint
Temporary or permanent
TemporaryThe sending server keeps the message and tries again later.
Who has to act
The sender. The fix is on the sending side: your domain, your server or your list.
What the server says
421 Deferred - see https://proofpoint.com/postmaster/?ip=1.2.3.4

What it means

This is Proofpoint’s temporary reply: your IP is being throttled because of unusual or unexpected sending patterns. Proofpoint’s FAQ adds that an IP showing signs of spam may be delayed for a short time and that the delay normally lifts automatically within minutes, with nothing for the sender to do. The message stays in your queue and your server retries it. Repeated deferrals are a warning, because an IP that keeps sending spam moves from delayed to blocked. New IPs are a common case: Proofpoint advises raising volume gradually, no more than double the previous volume at each step.

Common causes

  • A sudden jump in volume from your IP, for example a new campaign or a new IP sent at full speed.
  • Some messages from the IP scoring as spam.
  • Sending patterns that differ sharply from the IP’s history.

How to fix it

  1. 01Let your server retry; short delays usually clear by themselves.
  2. 02Slow the send rate from that IP and spread large sends over time.
  3. 03On a new IP, increase volume gradually, no more than twice the previous volume at each step.
  4. 04If the deferrals persist, check the IP on Proofpoint’s IP check page and review what you are sending.

Sources

What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.

  1. 421Service not available.The receiving server is closing the connection and will not take mail right now. The reply is temporary, so the sending server keeps the message and tries again later.StandardTemporary
  2. 554Blocked by Proofpoint for spam or malicious activity.Proofpoint has blocked your sending IP or domain because of spam it received or malicious activity it detected, and the reply links to its postmaster page.ProofpointPermanent
  3. 550 5.7.1Sending IP blocked by Proofpoint Dynamic Reputation.Proofpoint’s IP reputation system has your sending IP on its block list because it has seen spam or viruses from it, so Proofpoint customers refuse your mail.ProofpointPermanent

421 at other providers

  1. 421 [RP-001]Outlook.com rate limit for the sending IP.Outlook.com is limiting how fast your IP can send to it because of the IP or domain's reputation; it is temporary and your server should retry.MicrosoftTemporary
  2. 421 [RP-002]Outlook.com rate limit on this connection.Your IP has sent more over a single connection than Outlook.com allows, a limit Microsoft ties to IP and domain reputation.MicrosoftTemporary
  3. 421 [RP-003]Outlook.com connection limit.Your IP has opened more connections to Outlook.com than it is allowed, a limit Microsoft links to IP and domain reputation.MicrosoftTemporary
  4. 421Temporary error or deferral.Yahoo or AOL refused your message for now with a 421, one of its two temporary error codes. Your server should keep it and retry; repeated deferrals point to reputation or complaints.YahooTemporary
  5. 421Try again later.Xfinity turned the message away for now with a generic 421. Treat it as temporary and let your server retry: Xfinity uses it for several reasons it does not spell out.ComcastTemporary
  6. 421Reverse DNS lookup failed.Xfinity could not complete a reverse DNS lookup for your sending IP. It treats this as temporary, so your server should retry, but a broken DNS setup keeps it failing.ComcastTemporary

Further reading

All 3 Proofpoint codesEvery code in the wikiPaste your own bounce

Beat · paid monitoring

A heartbeat for your email.

Beat runs every check on this site on a schedule: 41 checks, 33 blacklists and real inbox placement. The moment something breaks, it tells you what broke, why it matters, and the exact fix.

example.comWatching
  • SPFpass
  • DKIMpass
  • DMARCp=none
  • Blacklists0 of 33

Illustrative. Your domain, every few hours.

Also from us:Pulse: your own sending infrastructureConsulting: $65/hr, no retainer