FAILED_PRECONDITION — Mail service not enabled
Your mailbox is misconfigured
The Gmail API returns HTTP 400 FAILED_PRECONDITION with "Mail service not enabled" when the account exists and the OAuth token is valid, but no Gmail service is attached to that user. The mailbox cannot send at all until an admin assigns a licence or re-enables Gmail for the organizational unit.
What the server actually says
http_400 | FAILED_PRECONDITION | Mail service not enabled | Precondition check failed.What you see
Authentication succeeds, the mailbox connects, and then every single send fails. Because it is a 400 rather than a 401 or 403, naive handlers file it as "unknown" and retry it forever.
Why it happens
- The Workspace subscription was cancelled or lapsed, removing Gmail from every user.
- The user’s licence was removed or downgraded to a SKU without Gmail.
- Gmail is switched off for the organizational unit the user sits in.
- The account is a Cloud Identity user, which can hold a valid token but has no mailbox.
How to fix it
- Check the user actually has a Gmail licence. Google Admin to Directory to Users to the user to Licences. A Cloud Identity-only user has no mailbox and never will until a Workspace SKU is assigned.
- Check Gmail is on for the OU. Admin to Apps to Google Workspace to Gmail to Service status. A parent OU with Gmail off overrides the user.
- Verify the subscription is current. An expired or suspended subscription disables mail delivery org-wide while leaving accounts and tokens intact.
- Stop the mailbox until it is licensed. There is nothing to wait for. The API rejected the call, so no message was created, no message-id exists, and no mailer-daemon will ever reply.
What not to do
- Do not retry on a schedule. This is a configuration state, not a transient error - retrying it every tick for days sends nothing and hides the real problem.
- Do not classify it as a network or server error. It is a 400: the request was understood and refused on its merits.
- Do not wait for a bounce. No message was ever created, so no bounce can arrive.
Frequently asked questions
Why is this a 400 and not a 403?
Google distinguishes "you are not allowed" (403) from "the preconditions for this call are not met" (400 FAILED_PRECONDITION). The token is fine; the account simply has no mail service to act on.
Will it fix itself?
No. It needs an admin to assign a licence or re-enable the service. No amount of retrying changes the account state.
Does the OAuth token need reconnecting after the licence is restored?
Usually not - the token was never invalid. Once Gmail is enabled for the user, the same credential starts working again.
How MailPilot helps
MailPilot classifies this error automatically on every connected mailbox and tells you which side is at fault, so a throttle is never mistaken for a dead recipient and a credential failure never suppresses a healthy address. It also monitors real inbox placement and checks SPF, DKIM and DMARC on every mailbox, which is where most policy rejections start.
Related errors
Last reviewed 2026-10-11 by the MailPilot team.