The red banner is Gmail's strongest warning short of not delivering the message at all. Unlike the yellow "Be careful with this message", which is often about authentication, the red one is mostly about what the message contains or links to: Gmail has decided it resembles phishing or malware closely enough to tell the reader to stay away. The sentence under the heading, often about a suspicious link or about similar messages having been used to steal personal information, says which.
When the banner lands on mail you sent in good faith, look at the message itself first.
Links
Most red banners on legitimate mail trace back to a link.
- A domain with a bad record. A link to a site that was hacked, that hosted phishing at some point, or that sits on a domain blocklist. The blocklist checker looks domains up on Spamhaus DBL, SURBL and URIBL.
- Shorteners and redirects. A link that goes through a public URL shortener or an open redirect hides its destination.
- Text that does not match the target. A link whose visible text is one address and whose
hrefis another. Tracking redirects in newsletters do this by design, which is why they should run through a domain of your own. - A brand new domain. A domain registered last week has no history for a filter to go on.
Attachments and requests
Dangerous attachments usually do not get this far. Gmail blocks executables, archives with executables inside, documents with malicious macros and password-protected archives that contain other archives outright, and the sender gets a bounce saying "This message was blocked because its content presents a potential security issue" instead of the reader getting a banner.
The requests in the message are a different matter. A message that asks the reader to sign in, confirm a payment or enter personal details through a link can draw the warning even when the request is genuine. A password reset that comes from the site's own domain and links only to that site gives a filter less to object to than one that passes through three domains.
Your account sending something it should not
If the banner appears on mail you did not write, or on a template that never triggered it before, check whether the account or the website that sends it has been compromised. Hacked accounts are often used for exactly the kind of mail Gmail is warning about, and the warning then attaches to your domain's reputation as well.
If authentication fails too
A message that fails SPF, DKIM and DMARC and also carries a suspicious link gets the strongest treatment. Fix both: the Gmail warning page covers the authentication half.
How the test reports it
Up to 50 links per message are opened and followed through as many as three redirects, and the final addresses are looked up in Google Web Risk and URLhaus. The same check records when each link domain was registered. Shortened links get a warning of their own, and so does visible link text that names one domain while the link leads to another. Attachments go through ClamAV, and a hit there is a failed check with a note that nothing else in the report matters until it is gone.