550 5.7.28: Gmail flagged an unusual rate of unsolicited mail

What the bounce means

A 550 5.7.28 bounce is Gmail blocking your sending source outright. The bounce text reads like this:

550-5.7.28 [203.0.113.9] Our system has detected an unusual rate of
unsolicited mail originating from your IP address. To protect our
users from spam, mail sent from your IP address has been blocked.

The key word is rate. Gmail is not judging the one message that bounced; it is judging the recent behavior of the source, the IP address or the authenticated domain, against its history. A source that normally sends a few hundred messages a day and suddenly sends fifty thousand looks like a spam operation, whatever the content says. The 5.x code makes it a hard rejection: retries will not get through until the verdict changes.

What usually triggers it

• A compromised account or abused form. A phished mailbox, a hijacked SMTP credential, or a contact form with no rate limit lets a spammer blast through your infrastructure. Your legitimate mail then bounces because the source's rate looks nothing like its history.
• A cold list, sent all at once. Importing a purchased or years-old list and blasting it produces exactly the pattern Gmail is describing: a surge of mail that recipients did not ask for, marked as spam at a rate your normal mail never sees.
• A new IP warming too fast. A fresh IP has no history, so any large volume from it is an unusual rate by definition. Reputation is earned gradually; skipping the ramp reads as a spam burst.

How the source recovers

• Stop the burst first. Pause the campaign or sending path that triggered the block. Continuing to hammer Gmail while blocked only deepens the verdict.
• Find and fix the cause. Check for a compromised account or an abused form before blaming the list. If it was a list, cut it back to recipients who actually opted in recently; the rest is what Gmail means by unsolicited.
• Resume low and slow. Restart with small volumes to your most engaged recipients and grow from there. Good sending is the only thing that rebuilds the reputation; there is no delisting form for this code.
• Watch the trend, not the bounce. Google Postmaster Tools shows the IP and domain reputation curve, so you can see the recovery happening instead of probing with test sends. Our Postmaster guide covers what each graph means.

Where authentication fits

SPF, DKIM, and DMARC will not lift a behavior block, but they decide whose reputation takes the hit. Without aligned authentication, Gmail can only score the IP, and on shared infrastructure that means you inherit every neighbor's behavior and they inherit yours. With aligned DKIM and a DMARC record, the reputation keys to your domain: your own history follows you across IPs and providers, and a spammer on the same IP cannot spend your goodwill. Verify your setup with a free DMARC audit while the volume is paused; it is the one part of recovery you can finish today.

Frequently asked

What does 550 5.7.28 mean?

Gmail detected an unusual rate of unsolicited mail coming from your sending source, usually the IP address, and blocked further mail from it to protect its users. It is a reputation verdict about the source's recent sending behavior, not a judgment on the one message that bounced.

Is 5.7.28 about one message or my whole sending?

The whole sending source. Gmail keys this block on the recent behavior of the IP or authenticated domain: how much mail it sent, how fast, and how recipients reacted. Fixing the individual message changes nothing; the burst or complaint pattern behind it has to stop.

How long does it take to recover from 5.7.28?

There is no published timer. Recovery follows the reputation: once the cause is fixed and the source resumes at low volume to engaged recipients, Gmail's verdict softens as the good sending accumulates. Watch the IP and domain reputation trend in Google Postmaster Tools rather than guessing.

Does setting up SPF, DKIM, and DMARC fix 5.7.28?

Not directly, because this is a behavior block, not an authentication failure. But authentication decides where the reputation sticks: with aligned DKIM and DMARC, Gmail scores your domain rather than whatever shared IP you send through, so one bad neighbor cannot drag you down and your own good history follows you.