Yahoo 554 5.7.9 and Gmail bulk-sender errors, decoded

What these bounces have in common

Gmail and Yahoo both tightened the rules for bulk senders (Yahoo and Google in February 2024, with Gmail's enforcement ramping through 2025). If you send real volume, you now need authenticated, aligned SPF and DKIM, a published DMARC policy, a low spam-complaint rate, and one-click unsubscribe on marketing mail. When you fall short, you get one of the codes below, and the first digit tells you what to do.

Yahoo 554 5.7.9: a policy rejection

Yahoo returns:

554 5.7.9 Message not accepted for policy reasons.

This is a permanent policy or authentication rejection, most often a DMARC failure, and very often on forwarded mail that hits a domain publishing p=reject. The fix is authentication and alignment, not a reputation appeal. (You may see 554 Message not allowed [320]quoted on third-party sites; that string is not in Yahoo's own documentation. 554 5.7.9 is the real one.)

Gmail's bulk-sender codes

Gmail splits the same failures into a temporary ladder (4.7.x, deferred and rate-limited) and a permanent one (5.7.x, blocked):

Temporary (4xx, back off):

• 421 4.7.28 unusual rate of unsolicited mail (by IP, netblock, or sending domain)
• 421 4.7.26 unauthenticated (no SPF or DKIM), 4.7.27 SPF did not pass, 4.7.30 DKIM did not pass, 4.7.32 From not aligned

Permanent (5xx, fix and resend):

• 550 5.7.26 unauthenticated, or blocked by your DMARC policy
• 550 5.7.27 did not pass SPF, 5.7.30 did not pass DKIM (bulk requirement)
• 550 5.7.28 unusual rate of unsolicited mail, blocked
• 550 5.7.25 sending IP has no PTR record

The one rule that matters: permanent vs temporary

• A 5xx is permanent. The message was refused and retrying sends the same bounce. Fix the cause, then resend. For this family the cause is almost always authentication or your DMARC policy.
• A 4xx is temporary. The receiver is deferring you, usually for rate or reputation. Slow down and fix list hygiene. Hammering retries without changing anything makes the reputation signal worse.

How to fix a permanent (5xx) rejection

• Publish and repair SPF and DKIM for every service that sends as you.
• Make sure at least one of them aligns with your visible From: domain (that is what DMARC checks).
• Publish a DMARC record (start at p=none if you have none, then ramp).
• For a 554 5.7.9 on forwarded mail, the durable fix is sender-side aligned DKIM, which survives forwarding where SPF does not.
• Resend only after authentication is corrected and verified.

How to fix a temporary (4xx) deferral

• Slow down and let the queue retry with backoff.
• Drive complaints down. Keep your spam-complaint rate below 0.1%, and never let it reach 0.3%.
• Warm up volume gradually instead of spiking.
• Add one-click unsubscribe (the List-Unsubscribe header with one-click support) to marketing mail.
• Clean your list: remove non-engagers, hard bounces, and spam traps.

Frequently asked

Does 554 5.7.9 mean Yahoo blocked me for spam?

Not exactly. 554 5.7.9“Message not accepted for policy reasons” is a policy or authentication rejection, usually a DMARC failure, and often on forwarded mail that hits a domain publishing p=reject. The fix is authentication and alignment, not a reputation appeal.

What is the difference between a 4xx and a 5xx mail error?

A 5xx is permanent: the message was refused, and retrying sends the same bounce, so you must fix the cause, usually authentication. A 4xx is temporary: the receiver is deferring you, usually for rate or reputation, so you should slow down and fix list hygiene rather than retry hard.

Why is Gmail rate-limiting me with 421 4.7.28?

Gmail has detected an unusual rate of unsolicited mail from your IP, sending domain, or links. It is a reputation and complaint-rate signal. Keep your spam-complaint rate below 0.1%, never let it reach 0.3%, slow your send rate, and clean your list.

Do I need one-click unsubscribe to send to Gmail and Yahoo?

For bulk senders, roughly 5,000 or more messages a day to Gmail, yes. A one-click List-Unsubscribe header is required, along with authenticated and aligned SPF and DKIM and a published DMARC policy.