Google Workspace emails going to spam: find the cause

Start here: five questions

First, what changed

Mail that landed last month and does not now almost always follows a change: a list import, a bigger send, a new template or tracking domain, a DNS edit, a new sending platform, or a new domain starting up. Name the change before reading any dashboard, because the dashboards show the effect and the change is the cause. If nothing changed on your side, the sudden-drop page covers what changes on the receivers' side.

The Postmaster-led diagnosis, in order

Verify the domain at postmaster.google.com with the DNS record it gives you, then read the dashboards in this order. Each reading points at a different fix.

1. 1

   Spam rate

   Google's line is 0.10%; past 0.30% Google will not mitigate until the rate has been below it for seven consecutive days. A rate above the line is a list or consent problem and nothing else on this page moves the tier until it falls.

2. 2

   Domain reputation

   Bad, Low, Medium or High, in Google's definitions (Bad: almost always marked as spam or rejected; Low: likely to be marked as spam). The tier lags behavior by days. Low or Bad with a clean spam rate points at dead addresses, a volume jump or a young domain.

3. 3

   Authentication

   The share of mail passing SPF, DKIM and DMARC. Anything under all of it is a DNS fix: an expired DKIM key, a platform signing with its own domain, an SPF record past ten lookups. The auth checker shows which.

4. 4

   IP reputation

   On Workspace the sending IPs are Google's and shared; a low IP tier with a healthy domain tier is not yours to fix. On a relay or your own server it is.

5. 5

   Delivery errors and encryption

   Rejections with their reasons, and the share sent over TLS. A rejection code here is decoded in the bounce code pages.

Authentication and alignment

Google's sender guidelines require every sender to pass SPF or DKIM and every bulk sender to pass both, with a DMARC record aligned to the From domain. On Workspace, SPF is Google's include and DKIM is the key you generate in the Admin console; the common failures are a second sending service added without alignment, a DKIM key never turned on, and an SPF record that grew past ten lookups. The auth checker reads all of it and, from a message's headers, whether alignment actually passed at Gmail. The rejection codes for each failure (550 5.7.26, 5.7.27, 5.7.30, 5.7.40, 421 4.7.32) are in the decoder.

The Workspace failure modes

• A domain under 30 days old. No history, filtered on caution regardless of the records. Outreach stops; a 21-day ramp runs; a placement test shows when Gmail trusts it. The Google Workspace warmup page covers the connect flow and the ramp against Workspace's limits.
• A volume jump. Workspace allows 2,000 messages a day per user; sending a few hundred cold emails from a mailbox that sent thirty last week reads as a spam pattern at any authentication. Google returns 421 4.7.28 for the unusual rate. Volume goes back to the curve and climbs from there.
• A trial or new tenant. Lower limits (500 messages and 500 unique external recipients a day on trial, per Google's limits page) and, usually, a domain registered for the purpose.
• A shared tracking or link domain. A sending platform's default tracking domain is judged on everyone using it. Put tracking on a subdomain you own, and keep links to domains you would send from.
• A consumer @gmail.com sending account. Google disconnects consumer accounts it decides are doing outreach, and the limit is 500 a day. Outreach sends from the Workspace domain.

Spam or Promotions

Gmail files a message to Promotions on a different judgement from spam: the sender was accepted and the content was classed as marketing. For one-to-one outreach that usually means unread, and the levers are the message (one person, no template, few links) and the domain's engagement record. For a newsletter the tab is often where readers expect it, and the Promotions page covers whether to fight it. A placement test reports the two separately, which is the only way to tell them apart.

The public record

When Postmaster is clean or empty and the mail still lands in spam, check what the receivers consult that you cannot see in Postmaster: a blacklist listing on the domain or its IPs, an expired DKIM key, reverse DNS on a relay, the domain's age. The domain reputation checker reads all of it in one report and gives the fix order.

The fix, in order

1. 1

   Fix the records

   SPF, DKIM and aligned DMARC on the Workspace domain and on every service that sends for it.

2. 2

   Fix the list and the volume

   Remove every hard bounce, send to addresses that engaged recently, and return the volume to a curve. This is what moves the spam rate and the tier.

3. 3

   Fix the message

   One message for one person, on your own tracking domain, with links you would send from.

4. 4

   Rebuild the engagement record

   Warming gives the domain the record Gmail is missing: real two-way threads read and kept by real mailboxes on a ramp, and it continues after so the record does not decay under the campaigns.

5. 5

   Test placement

   Per provider, before scaling. The tier lags; the test does not.

How warming works and the Free Deliverability Test are the fourth and fifth steps.