Fix Gmail API 4.7.28 Rate Limiting

Why does Gmail API return a 4.7.28 error during mass email sends?

You’re sending hundreds of transactional emails via Gmail API, everything’s set up right—SPF, DKIM, DMARC, compliant content—but suddenly, the API starts returning a 4.7.28 error. You didn’t change anything. Your sender reputation is clean. Why?

The answer isn’t spammy content or a broken authentication setup. It’s this: you’ve exceeded Gmail’s built-in sending limits per second or per minute. The 4.7.28 error is Gmail’s way of saying: “Slow down.” It’s not a judgment call. It’s a technical throttle.

Think of it like a highway with a speed limit. You can drive legally, but if you accelerate too fast or send too many cars in one second, the system blocks you—even if you’re in the right lane. This happens even with valid, well-structured emails sent from a trusted domain, simply because volume without pacing triggers rate limits.

Key takeaways

The 4.7.28 error means Gmail API is enforcing rate limits—commonly due to sending bursts that exceed per-second or per-minute thresholds.
It is not caused by content, sender reputation, or authentication issues—it’s a technical enforcement mechanism, not a block for abuse.
Even compliant senders see this error when sending large volumes without throttling or validating email lists to avoid wasted API calls.

How does a high bounce rate contribute to Gmail API 4.7.28 errors?

High bounce rates trigger Gmail API 4.7.28 errors because Gmail treats repeated failed deliveries as signs of poor send hygiene. Sending to invalid, role, or disposable emails creates noise, which Gmail penalizes by throttling your sending rate. Each failed attempt gets logged, reducing your available sending capacity over time.

Why Gmail treats bounces as red flags

You might think sending more emails means better reach, but Gmail’s systems prioritize reliability over volume. If your messages consistently bounce—especially to addresses that are outright invalid, role-based (like admin@, support@), or from disposable domains—it signals your list isn’t well-maintained. Gmail interprets this as spam-like behavior, even if your content is clean.

Let’s be clear: Gmail doesn’t care about your volume. It cares about whether your recipients actually receive your messages. Failed deliveries are a signal that a portion of your list is broken, and Gmail responds by restricting your access to prevent abuse of its infrastructure. This throttling manifests as the 4.7.28 error—meaning "too many errors or bounces during delivery attempt."

How bounced addresses drain your sending capacity

Every email that fails to deliver—even because of a temporary glitch—adds to Gmail’s internal error count. Over time, repeated failures across your domain, IP, or API client reduce your allowed rate limit. The more bounces you generate, the more aggressively Gmail restricts your sending window.

For instance, if you’re sending to a list with 30% invalid or disposable addresses, you’re effectively overwhelming Gmail’s systems with failed attempts. This isn’t about speed; it’s about credibility. High bounce rates degrade your sender reputation, and Gmail uses that signal to adjust quotas.

A single valid message sent to a known disposable email (like temp-mail.org) may still get rejected—Gmail blocks those domains entirely. But if you’re sending to 100 of them, that’s 100 failed attempts logged in Gmail’s system. That’s not a small cost; it’s cumulative throttle.

Preventing this starts with verification. Use tools like MailTester’s bulk verification to catch invalid, role, and disposable emails before sending. You can also integrate our real-time verification API to validate addresses at signup, reducing errors at the source.

Keep in mind: the best defense isn’t speed—it’s cleanliness. A list with low bounce rates maintains trust with Gmail’s systems and keeps your sending rate stable. See how your emails land in real inboxes with inbox placement testing—no guesswork, just data.

For more on how reputation and deliverability interact, see RFC 5321, which outlines SMTP delivery behavior. And while Google doesn’t publish exact bounce limits, the behavior aligns with industry-standard rate limiting mechanisms used by providers like SendGrid, Amazon SES, and Outlook.

What is the role of email verification in preventing rate limits?

Verifying email addresses before sending removes invalid, catch-all, and role-based addresses—common triggers of Gmail API rate limiting. A clean, accurate list reduces failed deliveries, which directly lowers the risk of hitting API rate limits during mass sends.

How verification reduces API strain

You're sending emails to 100,000 addresses, but 20% are invalid or role-based (like admin@ or sales@). Each failed attempt—especially to catch-all or non-existent addresses—counts against your Gmail API quota. These hits aren't just wasted effort; they trigger throttling. With a 98.9% accurate verification engine like MailTester’s, you identify and eliminate these problematic addresses before they ever reach the API.

Let’s say you verify a list of 10,000 addresses with MailTester. Out of those, 320 are caught as invalid, 180 are role accounts, and another 120 are catch-all. That’s 620 addresses that would’ve sent failed requests. Removing them before sending means 620 fewer API calls that could contribute to a 4.7.28 error.

Real-world impact on deliverability and API stability

Gmail’s rate limits are tied to sender reputation and the volume of failed delivery attempts. Sending to invalid domains or non-existent mailboxes signals poor list hygiene. Over time, this affects your sender reputation and increases the chance of throttling—even for valid emails. A clean list improves inbox placement and keeps your sending behavior within Google’s acceptable thresholds.

Tools like MailTester don’t just detect invalid emails—they assess risk factors such as syntax, domain validity, mailbox reachability, and role account indicators. Their real-time API and bulk verification features allow you to test your list before sending, and integrate directly with platforms like Mailchimp, HubSpot, and SendGrid. You can run an inbox placement test to validate deliverability, or use the API to verify individual addresses on the fly.

Every valid email you send has a better chance of landing in the inbox. Every address you remove before sending reduces the API load and lowers the odds of triggering a 4.7.28 error. It's not about sending fewer emails—it’s about sending only the right ones.

For a detailed look at how MailTester handles verification at scale, explore the bulk verification tool or view the pricing options for your volume. The real-time API can be integrated into your workflow to verify addresses as they’re added, reducing errors before they happen.

How to clean your email list to avoid 4.7.28 errors

Run your entire list through a bulk verification service to catch invalid and risky addresses before sending. Remove role-based emails (like admin@, sales@) unless you're targeting them directly. Block disposable domains in real time. Test deliverability with inbox placement tools before going live. These steps reduce bounce rates, lower spam complaints, and prevent rate-limiting errors like 4.7.28 in Gmail API during mass sends.

Step 1: Verify every address at scale

Use a bulk email verification tool to scan your full list. Look for hard bounces, syntax errors, and invalid domains.
Let’s be clear: sending to 10,000 addresses with 5% invalid ones is a direct path to hitting Gmail’s rate limits and triggering 4.7.28.
Services like MailTester’s bulk verification catch these issues upfront with 98.9% accuracy using real SMTP checks and MX validation.

Step 2: Filter out high-risk addresses and domains

Remove role-based emails (admin@, support@, info@) unless you're sending to a specific team. These often trigger spam filters and get ignored.
Disposable email domains (like mailinator.com, tempmail.org) are used for fake signups — they harm sender reputation. Use real-time detection to filter them out during upload or via the API.
Check domain reputation with tools that assess historical abuse or blacklisting — a common vector for email rejection.

Step 3: Test deliverability before sending

Even a clean list can fail if Gmail’s infrastructure detects suspicious sending patterns. Run inbox placement tests to see how your emails land in real inboxes.
Use tools like MailTester’s inbox tester to send test emails through real Gmail and corporate mailboxes. See whether they land in the inbox, spam, or get blocked.
Spam filters care about volume, content, and consistency. Sending to 5,000 new users in one hour, even with clean addresses, still risks 4.7.28. Start small and scale gradually.

Rate limiting errors like 4.7.28 aren’t just failures — they’re Gmail’s way of saying your sending behavior feels unnatural. Cleaning your list is the first step to behaving like a legitimate sender.

Don’t assume your list is clean. Even small errors compound at scale. A single disposable domain or outdated role account doesn't sound like a big deal — until it’s 10,000 such entries. Validate every address, block bad ones, test real delivery, and send in controlled batches. That’s how you stay below Gmail’s thresholds and avoid 4.7.28.

How MailTester’s real-time API helps avoid API rate limits

You can prevent Gmail API rate limit errors like 4.7.28 by validating email addresses in real time before sending. MailTester’s API checks validity, catch-all status, and risk level instantly—so you skip invalid or high-risk addresses entirely, reducing failed API calls and conserving your rate budget. This means fewer sends trigger throttling, and your bulk campaigns stay within Gmail’s limits. You’re not just sending less—you’re sending smarter.

Validate before you send, not after

Every API call to Gmail counts toward your quota. If you send to 10,000 addresses and 2,000 bounce due to invalid syntax or non-existent domains, those failed requests still consume your limit. With MailTester’s real-time API, you filter out the dead weight before the request ever leaves your system.

Let’s say you’re about to send a newsletter via Gmail. Instead of calling the API directly, you check each address through MailTester’s verification API first. It returns a response in under 200 milliseconds—valid, invalid, catch-all, or risky—with full detail. You skip the ones that don’t pass, and only send to the ones proven to be live.

Stop wasting calls on addresses that won’t work

Address validation isn’t just about deliverability—it’s about API economics. Sending to a catch-all or non-existent domain still counts as a transaction with Gmail, even if the message never lands. These calls don’t just fail—they burn through rate limits, especially during large sends.

MailTester’s real-time API identifies these risks before you make the call. That’s how you avoid the 4.7.28 error, which Gmail returns when you exceed your daily per-user or per-app rate limits. You’re not guessing. You’re acting on data.

For teams sending at scale, this reduces both bounce rates and API throttling. According to Google’s guidelines on API usage, consistent rate limit management is essential for long-term access. Validating your list first is a direct way to comply.

See how it works: test a list or integrate the API directly. Our system is built to handle real-world email data with 98.9% accuracy—no guesswork, no overloading.

Try MailTester’s real-time verification API to validate addresses before hitting Gmail.

What does the 'catch-all' verdict mean in email verification?

When email verification returns a "catch-all" verdict, it means the domain accepts email for any recipient address—even ones that don’t exist. These are not individual accounts, but generic inboxes designed to catch all mail, often used for automation, spam filtering, or shared mailboxes. Sending to catch-alls increases bounce risk and can trigger spam filters, especially with Gmail, which sees them as signs of low-quality or scraped lists.

How catch-alls work and why they matter

Technically, a catch-all address is configured at the domain level to accept all incoming mail, regardless of whether the recipient user exists. This means an email sent to [email protected] will still be delivered if the domain is set to catch-all. While this can be useful for support or feedback forms, it creates a blind spot for legitimate senders. Gmail and other providers treat catch-alls as high-risk: they’re common in low-quality or scraped email lists, and often used by spammers who don’t care if an address is real.

Let’s be clear: you don’t want your marketing or transactional emails going to catch-alls. They don’t represent real users. If your sender reputation suffers from high bounce rates due to these dummy addresses, you risk being throttled or blocked. Gmail’s infrastructure is tuned to detect patterns of mass sending to invalid or non-existent addresses—and catch-alls are a red flag in that logic.

What to do when you find catch-alls in your list

If your list includes catch-alls, it’s a sign that your data may have been harvested or poorly verified. You can’t trust these to be active, engaged contacts—you’re likely sending to noise. Removing them is the best move. But don’t rely just on your own tools: real-time verification catches many of these anomalies before you send.

Using a tool like MailTester’s bulk email verification helps identify catch-alls and other risky addresses before you send. It checks MX records, validates syntax, and checks against known patterns. The result? A cleaner, higher-quality list that's more likely to avoid throttling and bounce issues in Gmail and other providers.

For developers and marketers building email workflows, catching these early means fewer surprises when scaling outbound campaigns. Gmail’s 4.7.28 error—often cited during large sends—can stem from sending to known invalid patterns, including catch-alls. Fix the list at the source. For real-time validation during integration, use the MailTester API. It’s designed to catch these edge cases before they degrade your sender reputation.

For deeper insight into how Gmail evaluates delivery behavior, see how RFC 5321 defines SMTP-level handling of recipient addresses—especially when a destination doesn’t resolve or accepts all mail. This standard underpins why Gmail treats catch-alls as problematic in bulk flows.

How to integrate MailTester with Mailchimp, SendGrid, or HubSpot to prevent rate limits

You can prevent Gmail API rate limit 4.7.28 errors during mass email sends by verifying your list beforehand using MailTester’s API. Integrate it with Mailchimp, SendGrid, or HubSpot to scrub invalid, catch-all, or disposable addresses before sending. This reduces bounce rates, protects sender reputation, and keeps you within Gmail’s sending thresholds, which are typically capped at 500 emails per day per sender IP for new accounts.

Step-by-step integration to avoid rate limits

Verify your list before import — Use the MailTester API to validate your email list in bulk. Identify invalid, role-based, and disposable emails. Only valid, deliverable addresses go into Mailchimp, HubSpot, or SendGrid. This removes the root cause of excessive bounces that trigger rate limits.
Automate verification via webhooks — In SendGrid, set up a webhook to trigger MailTester’s API when a new list is uploaded. This ensures every incoming list is cleaned before delivery. You can also use cron jobs to run scheduled verification on recurring campaigns.
Filter at the source — Use MailTester’s real-time verification API in your app or CRM to drop invalid addresses before they reach your ESP. This stops problematic emails from ever entering your pipeline, reducing the chance of hitting Gmail’s 4.7.28 error due to high failure rates.
Monitor deliverability with inbox testing — After integration, run inbox placement tests via MailTester’s inbox tester to see how your emails land across Gmail, Outlook, and Apple Mail. This helps you adjust content and sending patterns to stay under detection thresholds.

Why this stops rate limits

Gmail’s rate limits aren’t arbitrary. They’re triggered by patterns linked to poor list hygiene — high bounce rates, spam complaints, or sending to non-existent addresses. By filtering out invalid recipients early, you avoid triggering defensive mechanisms. According to Google’s own documentation on delivery, consistent low bounce rates correlate with sustained access to the inbox. Google’s API quotas and sending guidelines emphasize that reliability, not volume, determines access.

The 4 steps described in “Step-by-step integration to avoid rate limits”, in order.

A well-verified list reduces the number of rejected messages. Even one invalid email can spike your rejection rate enough to trigger throttling. The fix isn't sending slower — it's sending smarter. Use MailTester’s bulk verification to clean large lists in minutes. For ongoing workflows, integrate the verification API directly. If you’re new, start with the free credits to test the flow. Your inbox placement, sender reputation, and send volume will improve — all without altering your messaging or timing.

Common missteps in Gmail API usage that trigger 4.7.28

You’re hitting the 4.7.28 rate limit error because you're sending too fast, using a single sender without domain warming, or sending to poorly cleaned lists. Google’s APIs enforce strict quotas—100 messages per 100 seconds for most accounts—and exceeding these triggers throttling. You’re not alone: even reputable senders get blocked when they skip pacing, warm-up, or list hygiene. It’s not about the tool, it’s about how you use it.

Send at the speed Google allows—never faster

Sending 10,000 emails in under 10 seconds exceeds Gmail’s default rate limits by design. The API caps most users at around 100 messages per 100 seconds—roughly one per second over time.
Use exponential backoff when the API returns a 4.7.28 error. Retry after 1 second, then 2, then 4, and so on. Waiting too long between retries wastes time; retrying too soon burns through your quota.
Consider using a queue system with a fixed rate cap (e.g., 10–15 emails per second). This maintains reliability and avoids throttling altogether.

Don’t send from a cold address or unclean list

Sending to thousands of recipients from one email address without warming it is like calling 10,000 people cold. Google sees this as spam behavior. Warm up your sender identity with small batches over days.
If your list has more than 15% invalid, disposable, or role-based addresses, you’re likely to hit the 4.7.28 error even with proper pacing. Invalid addresses generate bounces, and Gmail penalizes senders with high bounce rates.
Run your list through a tool like MailTester’s bulk verification before sending. It flags invalid addresses, catch-alls, role accounts, and disposable domains—helping you reduce bounce risk and protect your sender reputation.
Avoid sending to email addresses like admin@, support@, or sales@ unless you’re certain they’re meant to receive your message. These are often role-based and trigger spam filters.

Rate limiting isn't a bug—it’s a feature designed to prevent abusive sending patterns. You’re not failing the API. You’re failing to respect it.

The truth is, Gmail’s rate limits are predictable. What’s not predictable is how quickly your sender reputation degrades when you ignore list quality. Use verification tools to audit your list. Use MailTester’s real-time API to validate new sign-ups. And always retry failed requests with exponential backoff—this is an industry-standard practice, not just a suggestion.

How to set up proper throttling when using the Gmail API

You can prevent the 4.7.28 rate limiting error by enforcing client-side delays, tracking request counts, applying exponential backoff after failures, and logging responses to spot patterns. This keeps you under Gmail’s real-time limits and avoids API throttling that kills mass sends.

Implement client-side delay and usage tracking

Introduce a fixed delay of 500ms between every 100 API requests. This aligns with Gmail’s documented thresholds and helps avoid hitting the burst limit that triggers the 4.7.28 error.
Use an internal counter to track requests per minute. When nearing 100 requests in a 60-second window, pause execution until the counter resets. This prevents you from unknowingly breaching the limit.
Log each API response, especially status codes and retry-after headers. Over time, this reveals patterns—like spikes after certain operations—that help you refine your delay strategy.

Handle failures with exponential backoff

When you receive a 4.7.28 error, pause for 1 second before retrying. After each subsequent failure, double the delay—2s, 4s, 8s, up to a maximum of 30 seconds.
This adapts to transient load spikes and gives Gmail time to recover. It’s a standard practice in REST API design, aligned with Google’s own guidelines for handling transient errors.
Pair backoff with a capped retry count (e.g., max 5 attempts). Repeated failures after that should trigger a fallback, such as queuing or logging the issue.

For context, Google’s API documentation specifies that clients should respect rate limits and implement retry logic to manage congestion. You can find guidelines on error handling and throttling in the official Google API error codes documentation.

The 3 steps described in “Implement client-side delay and usage tracking”, in order.

Keep your system transparent. Use logs not just for debugging, but for proactive optimization—identifying which parts of your flow trigger delays or failures. This reduces surprises during high-volume sends.

If you’re checking email list health before sending at scale, consider using MailTester’s bulk verification to filter out invalid or risky addresses. It reduces send volume upfront, lowering the chance of API rate-limit triggers.

For real-time validation during integration, the MailTester API supports bulk validation with low latency—no need to rely on the Gmail API for basic checks. This offloads work and improves overall delivery reliability.

Can bulk verification completely eliminate 4.7.28 errors?

Even with a fully verified email list, rate limiting errors like 4.7.28 in the Gmail API can still occur.

Gmail enforces sending volume limits per domain and per user. These limits are not affected by list quality alone.

Best defense: Verified lists + controlled pacing

Verification removes invalid, disposable, and malformed addresses — reducing bounce risk and protecting sender reputation.
Combining verification with gradual send pacing keeps you under Gmail’s rate thresholds.
Rate limits are a system-wide constraint, not a flaw in your list. Prevention is not elimination.

Sources

Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)
Gmail delivered 87.2% of commercial email to the inbox in 2024 while sending 6.8% to spam — the best inbox rate of the four major mailbox providers. — Validity 2025 Email Deliverability Benchmark Report (2025)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What is the Gmail API 4.7.28 error?

It is a rate-limiting response from Gmail’s API when sending exceeds per-minute or per-second thresholds, often caused by sending to invalid or poorly managed lists.

Does using MailTester guarantee I won’t hit the 4.7.28 error?

No, but it significantly reduces the risk by weeding out invalid and catch-all addresses before sending.

How often should I verify my email list?

Before any major send campaign. For ongoing lists, verify every 60–90 days or after major updates.

Can disposable emails cause 4.7.28 errors?

Indirectly—disposable domains often result in bounces that trigger API limits due to high failure rates.

Why does Gmail care about bounce rates?

High bounce rates signal poor list hygiene, reducing trust and causing sender limits to be enforced.

How does MailTester’s 98.9% accuracy help?

It ensures that only valid, deliverable addresses are sent to, reducing failures that trigger rate limits.

Can role-based emails cause 4.7.28 errors?

Yes—role-based addresses often bounce or are treated as spam traps, increasing API error risk.

What happens if I ignore 4.7.28 errors?

Gmail will temporarily throttle or block sends until the sending behavior improves or the list is cleaned.

How do I detect if my email list has high bounce potential?

Run it through a verification tool—high invalid or catch-all rates are early warning signs.

Does MailTester work with SendGrid and HubSpot?

Yes—MailTester integrates with SendGrid, HubSpot, Mailchimp, and Klaviyo to verify lists at scale before sending.

Can I use a free tier to test verification before sending to Gmail API?

Yes—MailTester offers 100 free verifications to test list quality before any API integration.

Do purchased MailTester credits expire?

No—credits never expire, so you can batch-verifying as needed without time pressure.