Last spring a sender asked me to look at a newsletter that had "started going to spam in Gmail out of nowhere". Small shop, a few hundred subscribers, every message written by hand, a list built from their own customers. On paper there was nothing to fix.
Out of nowhere turned out to have a date. Two weeks earlier they had moved to a new sending platform, which meant a new IP with no history at Gmail, and the first campaign from it had gone out at full size on a Monday morning. The unsubscribe link on the new platform opened a page that asked people to sign in. A few of them pressed "Report spam" instead, because that button was right there, and on a list that small a few is enough to push the complaint rate past the line Gmail draws.
Nothing in the message had changed. Everything around it had, and all of it was visible from the receiving side. I went through the habit of reading a message from that side in why emails go to spam; this post is the Gmail-specific part.
What Gmail is actually weighing
Gmail does not publish its filter, and anyone who tells you the exact weights is guessing. What it does publish is the list of things it looks at, and years of watching many different senders go into Gmail have not contradicted that list once.
Authentication comes first. Can the message prove that the domain in the From header really sent it? That is SPF, DKIM and DMARC, and the word that matters is alignment, which I will get to.
Reputation is next, and it is two things, not one. The domain in your From header has a reputation. The IP address the message came from has another. A clean domain on a burned IP still has a problem, and so does the reverse.
Then comes engagement, meaning opens, replies, messages moved from spam to the inbox and messages deleted without being read, all of which Gmail sees per recipient and remembers.
Complaints are the fourth thing, and the "Report spam" button is the strongest single negative signal you can receive, and it is the one you will never see from your side unless you register in Postmaster Tools.
Content comes last, and it matters, but it matters after the other four have been settled. Perfectly ugly messages land in the inbox every day because the sender behind them was trusted.
The rules Gmail has enforced since February 2024
In February 2024 Google turned a set of recommendations into requirements. Yahoo did the same at the same time, with almost the same list. If you send to Gmail, this is the floor.
For every sender:
- SPF or DKIM authentication for your domain.
- Valid forward and reverse DNS for your sending IPs. The IP must resolve to a hostname, and that hostname must resolve back to the IP.
- TLS on the connection to Gmail.
- A spam rate in Postmaster Tools below 0.10%, and never above 0.30%.
- Messages formatted per RFC 5322.
- No Gmail addresses in the From header unless the message really comes from Gmail. Google has announced a DMARC quarantine policy for gmail.com, and a gmail.com From sent through somebody else's server is treated as spoofing.
Google also asks anyone who forwards mail, mailing lists and inbound gateways included, to add ARC headers, and subscribed mail to carry a List-id header.
If you send 5,000 or more messages a day to Gmail, on top of the above:
- Both SPF and DKIM, not one or the other.
- A DMARC record on your From domain, where the policy can be p=none but the record has to exist.
- The From domain must align with either the SPF domain or the DKIM domain.
- One-click unsubscribe per RFC 8058 in marketing and subscribed mail. That means two headers, List-Unsubscribe with an https link and List-Unsubscribe-Post with the value List-Unsubscribe=One-Click, and the request has to be honoured within two days.
- A visible unsubscribe link in the body as well.
The 5,000 threshold is counted per day, across all your mail to Gmail, and once you have crossed it Google keeps treating you as a bulk sender. Aim for the bulk list from the start. The cost is an afternoon, and it saves you from having to work out which day you crossed the line.
Postmaster Tools, and what the numbers mean
Google Postmaster Tools is free and it is the only window Gmail gives you into your own standing. You verify your domain with a DNS record and then wait for data. It needs volume to show anything at all, so a small sender may see empty charts for weeks, which is normal rather than a bug.
When the charts fill in, read these four.
Spam rate. The share of your delivered mail that recipients marked as spam. Under 0.10% is the target, and Google says a bulk sender above that already loses some inbox placement. Above 0.30% you also lose the right to ask Google for mitigation, until the rate has stayed under that line for seven days in a row.
Compliance status. The sender requirements from the list above, with your domain marked against each one. It is the newest page in Postmaster Tools, and the quickest way to see which rule you are breaking.
Domain and IP reputation. Four levels each, bad, low, medium and high, and medium was fine for most senders. Google is retiring both charts in the new version of Postmaster Tools, saying they were slow to move and easy to misread, so if your account still shows them, treat them as a late echo of your spam rate. On a shared IP the IP number was partly somebody else's behaviour anyway, which is the argument for a dedicated IP once your volume justifies one. Before that it is an argument against, because an IP with no history has no reputation to lean on.
Authentication. The percentage of your traffic that passed SPF, DKIM and DMARC. Anything under 100% on DKIM means some path in your setup is sending unsigned mail. A transactional system somebody forgot about, usually.
The mistakes that put good senders in spam
These are the ones I keep finding, and not among spammers but among people with real lists and real messages.
The platform signs with its own domain. The signature passes, and none of it counts for DMARC because the d= tag names the platform rather than you. Switch on the custom sending domain in the platform's settings. Almost nobody does it unprompted.
A new domain or IP sent at full volume. Reputation is history. A domain that appeared last week and sent ten thousand messages on day one looks like a domain that appeared last week in order to send ten thousand messages. So ramp it, starting with the subscribers who open everything, adding more each day, and giving it two or three weeks.
The From address wanders. hello@ this month, news@ the next, the founder's name on the third. Each change resets what recipients recognise and what Gmail has learned to associate with engagement, so pick one and keep it for years.
Image-only messages, one big picture with the text inside it and a link. Filters cannot read it, and they treat what they cannot read with suspicion, whereas real text, even a few lines, changes the verdict.
Link shorteners and mismatched links. A bit.ly link in a newsletter borrows the reputation of everything else ever sent through bit.ly. Link text that shows one domain and points to another is a phishing pattern, and it is scored like one even when the target is your own tracking domain.
An unsubscribe that asks people to log in. If leaving is hard, people press "Report spam" instead, because that button is right there and it works instantly. The one-click headers exist so Gmail can offer an unsubscribe of its own at the top of the message, which is far better for you than the alternative.
Sending to people who never asked, or asked years ago. Purchased lists, scraped lists, the export from a trade show in 2019. These lists contain spam traps and people who have forgotten you, and the complaint rate that follows is the one number you cannot argue with.
The order I fix things in
When something is wrong, I do not start with content. I go top down, because a fix lower on the list cannot help until the ones above it are done.
- Publish SPF for your From domain that includes your sending platform, and end it with ~all or -all.
- Turn on DKIM signing with your own domain. Check that the d= tag in the signature matches your From domain, or a parent of it.
- Publish DMARC. Start with
v=DMARC1; p=none; rua=mailto:dmarc@yourdomainand read the reports for two weeks before you tighten anything. - Confirm alignment. Send yourself a message, open it in Gmail, choose "Show original", and look for dmarc=pass. If SPF and DKIM pass but DMARC does not, alignment is the problem.
- Check the reverse DNS of your sending IPs, and that the HELO name matches. On a platform this is their job, but look anyway.
- Add List-Unsubscribe and List-Unsubscribe-Post to everything that is not a one-to-one reply, and make the link work without a login.
- Register in Postmaster Tools and watch the spam rate for a month.
- Clean the list. Remove anyone who has not opened anything in a year, and stop importing addresses you did not collect yourself.
- Ramp volume on anything new.
- Only now, content. Real text, your own domain in the links, a subject line a human would write.
Most of the surprises hide in step four, which is also the only step that takes five minutes.
Test the message before the real send
The last thing I do before a campaign goes out is send that exact message to a test address and read what the receiving side sees. Not a draft written for the test, but the real one, from the real platform, with the real links.
This is what I built the tester for. It hands you a throwaway address, the message goes there, and a couple of minutes on the report is up, with every authentication result, the DNS behind it and the blocklists. There is also a section that walks through the Gmail and Yahoo bulk sender rules one by one, with Google's own page quoted next to each finding, so you can check that I am not making any of it up. It is free and there is no account.
Then I send the same message to a Gmail address of my own, open it, and click "Show original". The top of that page has three lines, SPF, DKIM and DMARC, each with PASS or FAIL next to it. If all three say PASS and the DKIM line names your own domain, the message is authenticated the way Gmail wants it. If one of them says FAIL, that line is where to start, and the test report will tell you why.