A customer forwards a screenshot: your invoice, your newsletter or your password reset, with a yellow or red bar above it that starts "Be careful with this message". The heading is generic. The sentence under it is the part that names the reason, and Gmail changes that wording from time to time, so read it rather than the heading.
If the warning is on a message you received rather than one you sent, the part for you is at the end.
"Gmail couldn't verify that it actually came from…"
Of all the versions, this is the one a sender can fix completely. Gmail could not tie the message to the sender's domain. SPF and DKIM each failed or passed for some domain that does not match the From. Other versions of the same complaint say the sender "hasn't authenticated this message".
What to check, in this order:
- DKIM. Every service that sends as your domain should sign with a key published under it. A newsletter platform or CRM that still signs with its own domain is the most common cause.
- SPF. Look at
Return-Pathin the headers of the warned message. If it reads something likebounces.mailer-service.net, SPF passed for the service and not for you, and the fix is a bounce domain of your own at the service,bounce.example.comor similar; adding its servers to your record alone will not align it. - DMARC. A record has to exist, and one of the two above has to pass for the From domain or, under the default relaxed alignment, for another name under the same registered domain. When both pass for the wrong domain,
dmarc=failin the headers says so, and DMARC fail walks through reading it.
Each record can be looked up on its own with the SPF, DKIM and DMARC checkers.
Similar messages were reported or used for phishing
A message with perfect authentication can still get this version, which is about content and reputation: the message resembles mail that people reported, or it links somewhere with a bad record. The banner on the most serious of these turns red and says the message seems dangerous; that version has its own page.
On the sending side that usually means one of these:
- links through a URL shortener or a redirect domain that spammers also use;
- a link to a domain that is new, recently hacked, or listed on a domain blocklist;
- a template that asks for a login, a payment or personal details in a way that matches phishing.
Link to your own domain, drop the shortener, and check the link domains against a blocklist.
The sender's name matches someone in the organisation
Google Workspace can warn when an outside address uses a display name that matches a person inside the recipient's company. If your sales tool sends as "Anna Smith" and the client has an Anna Smith too, this is the cause, and a display name that includes the company is the obvious thing to try.
If you are the recipient
The banner protects you, and the safe default is to believe it. When you know the message is genuine, the banner's "Looks safe" option tells Gmail so for that message. Telling the sender what the banner said is the other useful step, since the cause sits on their side.
How the test reports it
Two of the three causes show up in the report. The authentication one is in the SPF, DKIM and DMARC results, read the way the DMARC fail page describes; the link one is in the shortener and link reputation checks covered on the red banner page. The display-name match leaves no trace in the message, since it depends on who works at the recipient's company. The banner itself does not show up either: with the inbox test included, one copy goes to a Gmail mailbox and you see the folder it landed in, nothing more.