Gmail transport-security rejection

Fix Gmail 550 5.7.29: email was not sent over TLS

Gmail returns 550 5.7.29 when a bulk-sender message was delivered without TLS. This is an outbound SMTP transport problem, not an SPF, DKIM, or DMARC DNS-record error.

Problem description

Gmail reports:

550 5.7.29 This message was blocked because it wasn't sent over a TLS connection.

Diagnostic availability: the current MailFixIt checker does not observe the historical sender-to-Gmail SMTP session. Message headers and sender logs are the relevant evidence.

Is this temporary or permanent?

550 is permanent for this attempt. Enable reliable TLS for the outbound path and send a new message.

Probable causes

The sending MTA did not offer or use STARTTLS.
A relay or gateway delivered the final hop without TLS.
TLS negotiation failed and the sender fell back to plaintext.
An old SMTP library or appliance lacks current TLS support.

How to diagnose and fix it

Identify which server made the final connection to Gmail.
Inspect its delivery log for STARTTLS offer, negotiation, protocol, and cipher.
Enable opportunistic or required TLS according to the sender/provider's supported configuration.
Fix certificate trust, protocol compatibility, or intermediary relay failures shown in logs.
Send a fresh message and verify the new Received headers report TLS.

Port 465 submission TLS and port 25 server-to-server STARTTLS are different contexts. Configure the actual failing hop.

Frequently asked questions

Does Gmail 5.7.29 refer to HTTPS?

No. It refers to TLS on the SMTP connection used to deliver the message to Gmail.

Is publishing a TLS DNS record enough?

No. The sending mail server must actually negotiate TLS on the outbound SMTP hop.

Does MailFixIt currently test the outbound hop?

No. A public destination probe cannot recreate the historical sender-to-Gmail connection.

Related email diagnostics

Primary sources: Gmail SMTP errors and codes and Google email sender guidelines.