Back to Blog

Marked Spam

A verified, source-backed guide to diagnosing Google Workspace email deliverability issues with Gmail, focused on authentication, reputation, and sender requirements.

emailgoogle-workspacedeliverabilityspamdmarc
Marked Spam

Google Workspace Email Going to Spam: A Verified Troubleshooting Guide

Last verified against Google documentation: January 2026

This guide is intentionally conservative and only includes claims backed by primary sources. It focuses on Gmail, because Google publishes specific sender requirements for mail sent to personal Gmail accounts (@gmail.com, @googlemail.com). If your spam issues are with other providers, validate their requirements separately. (Google Email sender guidelines)

Important context: Starting February 1, 2024, Google began enforcing stricter sender requirements. If your email "used to work" but now goes to spam, these requirements are likely the cause. (Google Email sender guidelines)

Scope and guarantees

Gmail sender requirements (verified)

These are the published Gmail requirements and guidelines that directly impact deliverability.

Requirements for all senders:

Additional requirements for bulk senders (5,000+ messages/day to personal Gmail accounts):

Note: Bulk sender status is permanent once assigned. Messages from subdomains count toward the same primary domain's 5,000-message threshold. (Email sender guidelines FAQ)

Verified causes of spam placement (prioritized)

1) Authentication failures or misalignment

  • Gmail checks SPF, DKIM, and DMARC. Missing or failing authentication increases spam or rejection risk. (Google Email sender guidelines)
  • DMARC requires alignment between the From: domain and SPF or DKIM domains. Misalignment is common with third-party senders. (Set up DMARC)

2) Invalid SPF configuration

  • SPF records must include all sending services for your domain. Missing senders leads to SPF failures. (Set up SPF)
  • A domain must not publish multiple SPF records; receivers treat that as an error. (RFC 7208, Section 3.2)

3) DKIM not enabled or broken

  • DKIM signs outgoing mail so receivers can verify authenticity. Missing or invalid DKIM is a negative signal. (Set up DKIM)
  • Gmail requires DKIM keys of at least 1024 bits for sending to personal Gmail accounts. 2048-bit keys are strongly recommended for security. (Set up DKIM)
  • Bulk senders must have DKIM enabled (in addition to SPF). (Google Email sender guidelines)

4) Poor reputation driven by spam complaints

  • Gmail tracks domain and IP reputation, and user-reported spam directly affects reputation. (Postmaster Tools dashboards)
  • Spam rates above 0.1% negatively impact inbox delivery. Rates of 0.3% or higher make senders ineligible for delivery support/mitigation. (Email sender guidelines FAQ)
  • Spam rate is calculated daily based on user-reported spam on messages delivered to the inbox. (Email sender guidelines FAQ)

5) Sending practices that trigger filtering

6) Infrastructure and DNS issues

  • Gmail requires valid forward and reverse DNS (PTR) records. The PTR record must resolve to a hostname, and that hostname's A/AAAA record must resolve back to the same IP address (forward-confirmed reverse DNS, or FCrDNS). (Google Email sender guidelines)
  • Bulk senders must use TLS for SMTP connections. All senders are strongly encouraged to use TLS. (Google Email sender guidelines)
  • Postmaster Tools Delivery Errors can indicate PTR, reputation, or formatting issues. Common error codes include 4.7.23 (PTR record issues), 4.7.27 (SPF failure), 4.7.29 (TLS missing), 4.7.30 (DKIM failure), 4.7.31 (DMARC missing), and 4.7.32 (DMARC alignment failure). (Email sender guidelines FAQ)

7) Shared IP reputation

  • If you use a shared IP address (common with email service providers), the sending behavior of other users on that IP affects your reputation. (Google Email sender guidelines)
  • A shared IP on a blocklist will cause delivery issues for all senders using it. Use Postmaster Tools to check IP reputation. (Google Email sender guidelines)

8) Forwarding and third-party senders

  • Forwarding breaks SPF because the forwarding server's IP isn't authorized in the original sender's SPF record. DKIM can fail if forwarding alters message content. (Google Email sender guidelines)
  • Third-party senders must authenticate correctly and align with your domain for DMARC to pass. (Set up DMARC)
  • If you manage a forwarding service or mailing list, add ARC (Authenticated Received Chain) headers to preserve authentication through forwarding. Note: ARC adoption is still limited, and some providers may not properly interpret ARC results. (Google Email sender guidelines)

9) Poor list hygiene and spam traps

Troubleshooting workflow (do this in order)

  1. Confirm the target provider. This guide is Gmail-specific (personal @gmail.com and @googlemail.com accounts). Requirements do not apply to Google Workspace accounts. (Google Email sender guidelines, Email sender guidelines FAQ)
  2. Check for error codes. If messages are being rejected, Gmail provides specific error codes (e.g., 4.7.23, 4.7.27, 4.7.29, 4.7.30, 4.7.31, 4.7.32, 5.7.25, 5.7.27, 5.7.29, 5.7.30) that indicate which requirement is failing. (Email sender guidelines FAQ)
  3. Collect message headers. Look for Authentication-Results and verify SPF, DKIM, and DMARC pass for the From: domain. Check for alignment issues. (Set up DKIM)
  4. Set up Postmaster Tools. Review spam rate, domain/IP reputation, authentication success, and delivery errors. Note that data may be delayed by 24+ hours and may be incomplete for low-volume senders. (Postmaster Tools setup)
  5. Audit SPF/DKIM/DMARC DNS records. Ensure a single SPF record (multiple records cause permanent errors), valid DKIM with 1024+ bit keys, and DMARC alignment. (Set up SPF) (Set up DKIM) (Set up DMARC)
  6. Verify PTR and forward DNS. Use tools like Google Admin Toolbox Dig to confirm PTR records resolve correctly and forward DNS matches (FCrDNS). (Google Email sender guidelines)
  7. Review sending practices. Verify opt-in, one-click unsubscribe for marketing messages (if bulk sender), consistent volume, and non-deceptive headers/content. (Google Email sender guidelines)
  8. Check infrastructure. Confirm TLS is used (required for bulk senders), and that mail is sent only from approved systems. (Google Email sender guidelines)
  9. Check shared IP reputation. If using an email service provider, verify the shared IP isn't blocklisted (e.g., Spamhaus) or low-reputation. Use Postmaster Tools to check IP reputation. (Google Email sender guidelines)
  10. Review list hygiene. Remove invalid addresses, avoid spam traps, and ensure you're not using purchased lists. (Google Email sender guidelines)

Remediation playbook (verified actions)

SPF: fix the foundation

  • Publish a single SPF record that includes every sending service. (Set up SPF)
  • Multiple SPF records are invalid and cause SPF errors. (RFC 7208, Section 3.2)
  • Google provides example SPF records and recommends keeping them current as senders change. (Set up SPF)

Example (Google Workspace only):

v=spf1 include:_spf.google.com ~all

Important: If you use other email services (e.g., marketing platforms, transactional email services), you must include them in your SPF record. For example:

v=spf1 include:_spf.google.com include:spf.mailservice.com ~all

Note: ~all (softfail) is recommended by Google. Use -all (hardfail) only after confirming all legitimate senders are included, as it causes stricter rejection of unauthorized mail.

DKIM: enable and validate

  • Enable DKIM signing for each sending domain and verify it passes in headers. (Set up DKIM)
  • Use 2048-bit keys if possible; Gmail requires at least 1024-bit keys. (Set up DKIM)

DMARC: start in monitoring, then enforce

  • Start with p=none and review DMARC reports before enforcing. (Set up DMARC)
  • Roll out enforcement gradually using pct, then move to quarantine or reject. (Recommended DMARC rollout)
  • For bulk senders, DMARC alignment requires the From: header domain to align with either the SPF domain or DKIM domain. DMARC supports relaxed alignment (default), where subdomains can align with organizational domains. (Email sender guidelines FAQ)

Example monitoring record:

v=DMARC1; p=none; rua=mailto:[email protected]

Reputation and spam complaints

List hygiene and sending practices

Infrastructure checks

  • Ensure PTR (reverse DNS) and forward DNS are valid for sending IPs. The PTR record must resolve to a hostname, and that hostname's A/AAAA record must resolve back to the same IP (FCrDNS). (Google Email sender guidelines)
  • Bulk senders must send mail over TLS. All senders are strongly encouraged to use TLS. (Google Email sender guidelines)
  • If using a shared IP, verify it isn't on public blocklists (e.g., Spamhaus). Consider a dedicated IP for high-volume sending. (Google Email sender guidelines)

Common Gmail error codes

When messages are rejected or rate-limited, Gmail provides specific error codes that indicate which requirement is failing. (Email sender guidelines FAQ)

Temporary failures (rate limiting):

  • 4.7.23: PTR record missing or forward DNS doesn't match sending IP
  • 4.7.27: SPF authentication failed
  • 4.7.29: Message not sent over TLS connection
  • 4.7.30: DKIM authentication failed
  • 4.7.31: DMARC record missing or no policy specified
  • 4.7.32: From: header not aligned with SPF or DKIM domain

Permanent failures (message blocked):

  • 5.7.25: PTR record missing or forward DNS doesn't match sending IP
  • 5.7.27: SPF authentication failed
  • 5.7.29: Message not sent over TLS connection
  • 5.7.30: DKIM authentication failed

These error codes help identify the specific requirement that needs to be fixed. (Email sender guidelines FAQ)

Postmaster Tools: interpret data carefully

  • Dashboard data is not real-time; updates can take 24 hours or more. (Postmaster Tools dashboards)
  • Low volume can hide data to protect user privacy. (Postmaster Tools dashboards)
  • Spam rate dashboards show user-reported spam on messages delivered to the inbox. If Gmail automatically filters most mail to spam before delivery, the spam rate can appear deceptively low because it only counts complaints on inbox-delivered messages. (Postmaster Tools dashboards)
  • Some dashboards only show data for messages authenticated with DKIM. (Postmaster Tools dashboards)
  • Postmaster Tools attempts to exclude forwarded messages, but some may still be included. (Postmaster Tools dashboards)

Sources and further reading (primary)

Google official documentation:

RFC standards:

Back to all posts