What 421 4.7.0 Means
421 4.7.0 is a transient policy rejection — the receiving server is deferring your mail because it considers the sending IP or domain unsafe. The most common cause is a public blocklist hit (Spamhaus SBL, XBL, CSS, or Barracuda), but it can also be a private reputation flag.
Most major receivers — including Microsoft 365, Gmail, Yahoo, and large enterprise gateways running ProofPoint or Mimecast — pass through 421 4.7.0 when an upstream policy filter rejects the connection.
Your sending IP is on Spamhaus SBL/XBL/CSS, or a similar public/private blocklist; spamtrap hits in your last campaign moved your IP into a soft-block state; you sent to a list with high invalid-recipient ratio (over 5%); or the IP's HELO/EHLO and reverse DNS don't match.
How to Fix 421 4.7.0
- 1
Check your sending IP against Spamhaus
Visit check.spamhaus.org and search by IP. If listed, the page will tell you which Spamhaus list (SBL, XBL, CSS, PBL, DBL) and link to the delisting form. Also run the Blacklist Checker at coldrelay.com/tools/blacklist-checker to scan 30+ major DNSBLs in one shot.
- 2
Identify the root cause before delisting
Delisting without fixing the cause gets you re-listed within hours. Common causes: a compromised mailbox sending spam, a malware-infected device on the same IP range, sending to a list with high spamtrap density, or sending high volume from a cold IP without warmup.
- 3
Request delisting from Spamhaus
Spamhaus self-service delisting works only if the root cause is resolved AND it's the first or second listing. Repeat offenders are reviewed manually. Fill out the form at check.spamhaus.org with a concise root-cause + remediation statement. Most legitimate senders are delisted within hours.
Note: Do NOT request delisting until you've genuinely fixed the cause. Repeated reactive delisting damages your IP's review-priority and pushes future listings into manual queues.
- 4
Verify reverse DNS matches HELO
Even if Spamhaus delists you, Microsoft 365 and Gmail will keep returning 421 4.7.0 if your sending IP's PTR record doesn't resolve to a hostname that matches your HELO. PTR forward+reverse must match. Most sending platforms get this right by default; if you self-host, this is the most overlooked cause.
- 5
Re-warm the IP if you triggered a high-volume listing
If the listing came from a sudden volume spike, the underlying reputation damage takes weeks to recover even after delisting. Resume sending at 10% of pre-incident volume and ramp up by 25% per week. ColdRelay's automated warmup schedule (in the Warmup Schedule Generator at coldrelay.com/tools/warmup-schedule-generator) gives you a daily plan.
- 6
Pause sending to confirmed spamtraps
Run your list through an email verification service before resending. Spamtrap hits are the #1 cause of Spamhaus listings — even a tiny percentage of spamtrap addresses in a 10K-recipient send can trigger a CSS or XBL listing.
References
- ◇Spamhaus Lookup
Search by IP or domain to see which Spamhaus list (if any) you're on.
- ◇Spamhaus CSS Explanation
CSS is the most common cold email listing — it targets compromised authentication and snowshoe patterns.
- ◇
421 4.7.0 in the Cold Email Context
Spamhaus listings are the cold email infrastructure provider's primary risk. Shared sending IPs at low-end providers are constantly cycling through Spamhaus listings because one bad customer's spamtrap hit gets the IP listed for everyone. The structural fix is dedicated IPs that nobody else sends from. ColdRelay provisions a dedicated IP per customer inside an isolated Azure tenant — your IP's reputation is entirely yours, and you'll never get listed because of someone else's bad behavior. ColdRelay also monitors major blocklists automatically and alerts you within minutes if your IP shows up on Spamhaus SBL, XBL, CSS, Barracuda, SORBS, or SpamCop.
Frequently Asked Questions
How fast does Spamhaus delisting take?
For first-time listings on SBL or CSS with a real root-cause fix, self-service delisting usually completes within a few hours. Repeat offenders go into a manual review queue that can take 24-72 hours. XBL is automatic — once the underlying infection or compromised account is cleaned, the listing typically expires within 24 hours without manual intervention.
Will my IP get re-listed after delisting?
If you didn't fix the root cause: yes, almost immediately. Spamhaus monitors continuously, so any new spamtrap hit or sustained spam pattern from the same IP will re-trigger the listing within hours. The delisting form requires a root-cause statement for exactly this reason.
Does Spamhaus listing affect my domain reputation too?
Direct: only if your domain is on the DBL (Domain Block List). IP listings don't directly damage domain reputation. Indirect: yes — if your IP is heavily listed, your domain's deliverability suffers because most receivers check both, and a listed IP signals that the domain is being used for spam regardless of its individual reputation.
Can I just use a different IP to bypass the listing?
Technically yes, but switching IPs without fixing the cause just re-lists the new IP within days. Also, repeatedly burning IPs is a pattern Spamhaus tracks — they list contiguous ranges (CIDR blocks) when one tenant cycles through many IPs quickly. Fix the underlying cause first.
What's the difference between SBL, XBL, CSS, and PBL?
SBL (Spamhaus Block List) lists IPs that send spam directly. XBL (Exploits Block List) lists IPs running open proxies or malware. CSS (Compromised Sender Set) lists IPs and IP/domain pairs showing snowshoe or compromised-credential patterns — most common for cold email. PBL (Policy Block List) lists IP ranges that shouldn't be sending mail directly (e.g. consumer broadband). For cold email infrastructure, CSS and PBL are the most common.