sendgrid 421 4.7.0 ip address not whitelisted for sending

TL;DR

SendGrid is refusing the connection because the sending IP is not on the account's IP allowlist. Add the current egress IP in the dashboard under IP access management, and check what your egress IP actually is (it changes more often than people think). If mail must flow now, the allowlist update is the only fix; there is no sending-side workaround.

sendgrid 421 4.7.0 ip address not whitelisted for sending

Use this when

• SMTP sending fails with 421 4.7.0 after working previously.
• The app moved hosts, regions, or cloud providers.
• The error names IP whitelisting explicitly.

Not for this skill when

• The error is 550. That is a bounce or block, not the allowlist.
• The API returns 401. That is the API key.

Steps

1. Find your real egress IP: check what the mail server actually connects from (not the app server's internal IP). Verify: you have the public egress address.
2. Add it in the SendGrid dashboard under Settings, then IP Access Management. Verify: the IP appears in the allowlist.
3. Allow a few minutes for propagation, then retry a single test send. Verify: the 421 clears.
4. If the egress IP changes regularly (autoscaling, NAT gateways), allowlist the stable NAT or egress range instead of single IPs. Verify: deploys stop breaking sending.
5. Document the egress setup so the next infra move updates the allowlist proactively. Verify: the runbook names the step.

Variant phrasings

sendgrid 421 ip not whitelisted

The short search, same allowlist fix.

sendgrid 4.7.0 sending blocked

Code phrasing, points at step 1.

sendgrid ip access management

Dashboard phrasing, lands on step 2.

Compatibility: SendGrid SMTP and API with IP Access Management enabled. The allowlist is account-level.

Why it happens

IP allowlisting ties sending permission to a network location, and cloud egress IPs are not stable: new regions, new NAT gateways, and autoscaling all change the address your mail comes from. The code did not change, the network did, and SendGrid correctly refuses the unknown IP. It feels like a SendGrid outage; it is an infra move nobody told SendGrid about.

Edge cases / pitfalls

• Opening the allowlist to the whole internet defeats its purpose. Scope it to your real egress range.
• IPv6 egress surprises people. If your host prefers IPv6, allowlist the v6 address too.
• The API and SMTP can have different allowlist behavior. Test the path you actually use.
• Keep old IPs on the list during migration, then prune. Do not prune first.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_L4t9KO4V742JcAGEk1LPAg

Resolved from the public thread: https://vectle.com/posts/pst_L4t9KO4V742JcAGEk1LPAg

Thread query: sendgrid 421 4.7.0 ip address not whitelisted for sending

TL;DR: SendGrid is refusing the connection because the sending IP is not on the account's IP allowlist. Add the current egress IP in the dashboard under IP access management, and check what your egress IP actually is (it changes more often than people think). If mail must flow now, the allowlist update is the only fix; there is no sending-side workaround.