Gmail reject vs. quarantine: what you actually see when compliance fails in 2026

“Gmail rejected my email” and “Gmail put my email in spam” used to be treated as roughly the same problem: something about the message or the sender wasn’t good enough. Since Gmail’s enforcement hardened in November 2025, they’re no longer interchangeable. A rejection, a temporary throttle, and silent spam-foldering are three distinct failure modes with three different signatures in your own send logs — and only one of them tells you anything at all without extra tooling. If you’re troubleshooting Gmail deliverability in 2026, knowing which one you’re looking at is most of the diagnosis.

The three failure modes

Hard rejection — a permanent 5xx SMTP response. The message is refused outright, at the moment of the SMTP conversation, and never retried. Your sending platform’s logs will show a bounce, and the extended status code tells you why. 550 5.7.26 specifically means the message failed authentication — SPF and DKIM both did not pass. This is the code Gmail’s November 2025 enforcement shift made far more common: authentication failures that used to quietly land in spam are now refused before delivery happens at all.

Temporary deferral — a 4xx SMTP response, meant to be retried. 421 4.7.28 is the classic example: “unusual rate of unsolicited mail,” Gmail’s way of saying your sending IP or domain tripped a volume- or reputation-based throttle. This is a soft bounce in the traditional sense — your platform should retry automatically, and if the underlying cause (usually a spike in volume against a fresh or damaged reputation) resolves within a day or two, delivery often recovers without any other change.

Silent spam-foldering — no error at all. The SMTP transaction completes normally, your platform logs the message as delivered, and Gmail’s content and engagement filters route it to spam after acceptance. This is the failure mode senders miss for weeks, because there’s nothing in a send log to flag it — the only symptom is opens and replies quietly drying up.

	Hard rejection	Temporary deferral	Silent spam-foldering
SMTP signature	5xx, permanent	4xx, retried automatically	None — accepted normally
Example code	550 5.7.26	421 4.7.28	No code at all
Visible in send logs?	✓	✓	—
Root cause	Authentication (SPF/DKIM) failing	Volume/reputation throttle	Content or engagement signal
Typical fix	Repair SPF/DKIM/DMARC alignment	Slow down, let retries resolve	Improve relevance/targeting, verify with a seed test
How senders usually notice	Immediately, via bounce report	Within a day or two, via bounce report	Weeks later, via falling opens/replies

A worked example: the same domain, three different Tuesdays

It helps to see how these look in practice on one sending domain over time, because the same underlying reputation problem can surface as any of the three depending on what specifically triggers it that day.

Week one: a newly connected mailbox with no sending history gets loaded straight into a 2,000-email campaign. Gmail’s rate-based throttle kicks in almost immediately — 421 4.7.28 deferrals across a meaningful share of the send, all of them retried and mostly delivered within 48 hours as the platform backs off and spaces out the remaining volume. Annoying, but self-healing, and nothing about DNS or authentication was ever the problem.

Week three: someone edits the domain’s SPF record while adding a new sending tool and accidentally publishes a second SPF TXT record instead of merging into the existing one — multiple SPF records is an automatic fail. The next campaign gets hit with 550 5.7.26 hard rejections across the board, visible immediately in the bounce report, because authentication is now broken for every message regardless of content or reputation.

Week six: DNS is fixed, throttling has eased, and the campaign sends clean by every log available — no bounces, no deferrals, delivery logged as successful. But replies have quietly dropped to near zero and open rates look unusually low for a list that used to perform. Nothing in the platform’s own reporting flags a problem, because there isn’t one from the sending infrastructure’s point of view — the mail is landing in spam after acceptance, and only a seed-list placement test or a look at Postmaster Tools data reveals it.

Same domain, three unrelated root causes, three completely different signatures — and none of them would have been fixed by applying another failure mode’s remedy.

Why the fix is different for each one

A 550 5.7.26 rejection means your DNS records are broken or misaligned — fix SPF, DKIM, and DMARC alignment, and the next send should go through cleanly. Retrying the same message without fixing the underlying records just produces the same rejection again.

A 421 4.7.28 deferral means your sending pattern, not your authentication, tripped a limit — slow down, avoid sudden volume spikes on a domain or IP with limited sending history, and let the automatic retry do its job. Pushing more volume at a domain that’s already being throttled usually extends the block rather than clearing it.

Silent spam-foldering is the one that isn’t about a broken setting at all — it’s a reputation and relevance signal. Authentication passing and volume being reasonable doesn’t guarantee inbox placement if recipients aren’t engaging, or if your list includes people who never asked to hear from you.

For a full walkthrough of pulling the raw SMTP response and headers off a specific bounce, this header-reading field guide covers the mechanics — this post is about which of the three outcomes you’re looking at once you have them in front of you. Getting that classification right before you start changing DNS records or slowing down sending saves a lot of wasted troubleshooting time, since the fix for a rate throttle does nothing for an authentication failure and vice versa.

Frequently asked questions

Can one email trigger more than one of these failure modes?+

Not on the same delivery attempt — a message either gets a permanent rejection, a temporary deferral, or acceptance followed by spam-foldering, since those are mutually exclusive outcomes of a single SMTP transaction. But a domain can experience all three across different sends if it has both authentication gaps and reputation problems at once.

Should I keep retrying after a 550 rejection?+

No. A 5xx code is Gmail telling your platform not to retry as-is — the message needs its underlying problem fixed (usually SPF/DKIM/DMARC alignment) before a resend has any chance of succeeding, and repeated identical retries can themselves look like abusive behavior.

Is silent spam-foldering more common than the other two?+

For domains that already pass authentication and aren't sending at an unusual volume, yes — once the technical requirements are met, engagement and content signals become the dominant factor in placement, which is why relevance and list quality matter even after DNS is fully correct.

What this means if you’re sending with Norbelys

The two most avoidable failure modes above have direct product answers. A 421 4.7.28 throttle is triggered by sudden volume against a domain with limited sending history — which is exactly what Norbelys’s warmup ramp is built to prevent: a new sender climbs a daily volume curve instead of going from zero to campaign-scale overnight. A 550 5.7.26 rejection is a DNS problem, not a sending-pattern one, and Norbelys’s DMARC monitoring tracks SPF/DKIM/DMARC alignment per sending domain on an ongoing basis, so a misconfigured record shows up before it produces a hard bounce across a whole send instead of after.