Gmail deferred or blocked your message because the domain in its From: address has no DMARC record, or has one that doesn’t set a policy. The fix is one TXT record at _dmarc, and p=none is enough. Enter your From: domain to see what Gmail finds and the exact record to add.
Last verified 9 October 2026.
Enter the domain of the From: address in the message that bounced, or paste that message’s headers. The lookups run in your browser against public DNS.
Next steps
This reads public DNS. It doesn’t check whether your mail passes SPF or DKIM for an aligned domain, which DMARC also needs: see Gmail 4.7.32 / 5.7.32 for that.
What this can and can’t tell you: it queries _dmarc.<domain> TXT through Cloudflare’s public resolver (Google’s when Cloudflare’s fails), follows a CNAME there to a hosted DMARC service, and for a subdomain without a record walks up to its organizational domain (the RFC 9989 tree walk, as the DMARC checker does, skipping public suffixes such as co.uk or com.pe from the ICANN section of the Public Suffix List, and hosting platforms such as github.io). It also asks a made-up name on your domain, so a wildcard isn’t mistaken for your record. Pasted headers stay in your browser: only the From: domain is looked up, and a link to a result holds only that domain. A lookup that fails shows as “unknown”, never as missing.
Google’s SMTP error reference lists two codes for this, with the same cause:
421 4.7.40 Your email has been rate limited because the sending domain doesn't have a DMARC record, or the DMARC record doesn't specify a DMARC policy.
550 5.7.40 Your message was blocked because the sending domain doesn't have a DMARC record or the DMARC record doesn't specify a DMARC policy.
Both add: “Gmail requires all bulk email senders to add a DMARC record to their sending domain.” The sending domain here is the domain in the From: address.
421 4.7.40 | Rate limited (temporary). Your server retries, and Gmail keeps deferring mail like it until the domain has a DMARC record with a policy. |
|---|---|
550 5.7.40 | Blocked (permanent). The message isn’t delivered. Add the record, then send again. |
| “doesn’t have a DMARC record” | Nothing at _dmarc.<domain> starting with v=DMARC1, and no organizational-domain record covering a subdomain. Two v=DMARC1 records at one name are all discarded (RFC 7489 §6.6.3, RFC 9989 §4.10). |
| “doesn’t specify a DMARC policy” | A v=DMARC1 record without p=, or with a p= value other than none, quarantine or reject. |
504 5.7.40 | A different error. Google’s table also lists 504 5.7.40 “Unrecognized authentication type” and “XOAUTH is no longer supported”: these are about how your mail client or app signs in to Gmail’s SMTP server, not about DMARC. |
Bounce texts quoted from Google Workspace Help, Gmail SMTP errors and codes (page last updated 2026-10-07, checked 9 October 2026); RFC 7489 §6.6.3; RFC 9989 §4.10.
At the DNS host for your domain, add one TXT record:
Type: TXT
Host: _dmarc (full name: _dmarc.example.com)
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comv=DMARC1 comes first, exactly as written (the version value is case-sensitive), followed by a semicolon.p=none is enough for Gmail. Google’s sender guidelines for bulk senders: “Set up DMARC email authentication for your sending domain. Your DMARC enforcement policy can be set to none.” It asks receivers to take no action against mail that fails DMARC, so it is the safe place to start.rua= is optional. It is where receivers send daily aggregate reports. Use a mailbox you read or a reporting service’s address, or leave it out.v=DMARC1 record is already there, edit it instead of adding a second one (multiple DMARC records)._dmarc means a hosted DMARC service manages the record. If it leads nowhere, fix the domain’s setup at that service, or delete the CNAME and add your own TXT record: a TXT record can’t sit beside a CNAME.A DMARC record doesn’t make your mail pass DMARC by itself. Gmail also checks that SPF or DKIM passes for a domain aligned with your From: domain; if it doesn’t, the next bounce is 4.7.32 / 5.7.32. Once your reports show your mail passing, you can move to quarantine or reject (how to enforce safely).
Source: Google, Email sender guidelines (checked 9 October 2026).
Same cause, different outcome. 4.7.40 means Gmail rate limited the message (a temporary failure, so your server retries); 5.7.40 means it blocked the message (a permanent failure). Publish a DMARC record either way: retries keep failing until the record is there.
Yes. Google’s sender guidelines say: “Your DMARC enforcement policy can be set to none.” What Gmail needs is a record at _dmarc.<your domain> that starts with v=DMARC1 and has a p= tag set to none, quarantine or reject. A record without p= doesn’t specify a policy, which is the second case the 5.7.40 text names.
Not usually. When a subdomain such as news.example.com has no record of its own, DMARC uses the organizational domain’s record at _dmarc.example.com, with its sp= policy if it has one and its p= policy if not. One record at the organizational domain covers every subdomain without its own.
A new record is usually visible within minutes. If your domain had no record before, Gmail may have cached that answer for up to the negative-caching time in your zone’s SOA record, often an hour or less. A changed record can take up to the old record’s TTL. Check it here, then resend.
If you manage sending domains for clients or brands, Email Security Signals checks a whole list and returns one row per domain with the DMARC policy, SPF, DKIM selectors found and an A–F grade, ready to export as CSV. $0.02 per graded domain ($20 per 1,000); invalid inputs, domains that don’t exist, DNS lookup failures and duplicates are free.
Check a list on the Apify Store →Related: Gmail 4.7.32 / 5.7.32 (From: header not aligned), Gmail 550 5.7.26 (sender unauthenticated), multiple DMARC records, DMARC policy not enabled, bulk sender requirements and the free DMARC, SPF and DKIM checker.