Problem with Gmail Spam Detection

spam folder

[Kendo]

Most posts about Gmail spam detection seem to be concerned about how well it prevents spam.

But I have the opposite problem. People contacting us from our website are not receiving our replies because they are going straight into a SPAM folder that is probably so full that they don't get noticed. I had suspected this, especially when seeing that some are preferring to return to our on-page chatbox.

Of the last 10 new signups to use a free online scoreboard service for video overlays, only 2 had received our return email requesting validation. This service is not as strict as others that we provide and by not confirming receipt of that email, normally they would not gain access.

It is an ongoing problem - people email from our websites and the replies end up in their SPAM folder.

Our mail server is on dedicated hardware and it has never been compromised. All configurations for SPF, Dmarc, etc are 100%. We don't spam but do send notices to existing clients about updates every few months. We are not on any blocklists - except UCEPROTECT which should be ignored by everyone because it is a scam.. they had he.net's whole IP range blocked for a year, demanding that their clients pay to be whitelisted.

Gmail spam detection is killing us!

[thecoalman]

Quick tip, if you open email as source in Gmail panel it will give you information about valid/invalid DKIM, SPF and DMARC.

[Kendo]

if you open email as source in Gmail panel it will give you information about valid/invalid DKIM, SPF and DMARC

I don't see an option for that on my Gmail pages.

So I downloaded the email and in Notepad I can see pass, pass, pass.

But I did find my own email in SPAM folder.

[thecoalman]

You need to click the three dots and select Show original.

[Brett_Tabke]

I've read and read about this as email is once again a seriously important marketing channel.

Yes, you are not imagining it. Gmail's spamo filters have become extremely aggressive. Seems to be especially true with small-volume senders or transactional oriented messages that look similar to automated. I have had the same problem here for some time.

Even with valid SPF/DKIM/DMARC, Gmail assigns a reputation score to the domain and sending IP based on user engagement. If your messages don't get much engagement, they'll quietly start getting filtered.

A few things I've peiced together that might help:

• Add a whitelist prompt on your signup confirmation page and ask users to check spam and mark your messages as "Not Spam."
  
  
• This is the most significant bit: Warm up the domain/IP by gradually increasing sends and encouraging engagement (opens/clicks).
  
  
• Personalize your from and subject lines - avoid typical boilerplate Account Verification phrasing, which Gmail's filters flag constantly.
  
  
• Check your domain reputation at [postmaster.google.com ] . It shows how Gmail currently scores your IP and domain.
  
  
• Use a subdomain (like mail.yourdomain.com) dedicated to these types of transactional messages; this isolates reputation from your main domain.
  
  
• This is hard, but I hear it helps: Add BIMI and a proper favicon-style logo to help brand recognition in Gmail.
  

Unfortunately, Gmail's machine-learning spam filters have gone far beyond what SPF/DMARC can fix and even legitimate senders are collateral damage.

If you're seeing this across most new users, you might experiment with a transactional mail provider (like Amazon SES or Mailgun) for those first contact emails - they usually have higher initial trust.

[goodoldweb]

One more way google blocks businesses from reaching thier customers.

We've had the same problem although our SPF/DKIM/DMARC check absolutely fine.

Our only working solution was to use Google's SMTP servers. Trying to reach our customers gmail accounts is a hit and miss if we try using our own SMTP server.

[lucy24]

If it’s any comfort, this is by no means unique to G###. MacMail always sorts mail from certain sources into Junk or Spam, even when it knows the mail belongs in some other specific folder. (I can tell, because when I click the Move To box, it is immediately populated with the appropriate name.)

[Kendo]

Check your domain reputation at [postmaster.google.com ] . It shows how Gmail currently scores your IP and domain

I can see that a newsletter to clients and interested parties about a month ago logged a 3.8% spam rate. But that should be below par for the course. But they reckon that a spam rate of 0.3% or higher will severely impact your deliverability - this is ridiculous because one only needs 1 person out of 100 to complain, and we all have competitors in our address books - that's why they put themselves there!

Otherwise there are no records for any of our other sites.

Interesting - Google also provides a link for Compliance status but that reports that both SPF and DKIM needs work. Yet their own mail headers report 100% pass, and tests at [mail-tester.com...] report 10/10 which is not common.

Is anything G not broken?

What would be useful is that Google report the email address that complained, so that we can remove the offender, instead of providing yet another tool that can be used to defame us.

[goodoldweb]

@Kendo

It is not in Google best intrest to let businees drive traffic directly to thier own websites. Less ad clicks, less control.

It's really as simple as that.

[Brett_Tabke]

> and we all have competitors in our address books - that's why they put themselves there!

That's why a 'double opt-in' is so important. Here is the thing that gets over spam reports - remind them of why they are getting the email. Do this right above the unsubscribe link.

"You are getting this email because you subscribed to XYZ email list for new email notifications/ newsletters/ offers/ whatever. If you wish to not get these any more, simply click <a....>unsubscribe</a> here. "

also, I hear you should include a "subscribe" link, somewhere near the unsubscribe link, as people some times hit it by accident and need to resubscribe. This also lead too, unsubscribe should not be the last link on the page. Try a 'contact us' or something instead. (don't make it too easy to accidently hit it)

[lucy24]

I hear you should include a "subscribe" link, somewhere near the unsubscribe link, as people some times hit it by accident and need to resubscribe

Wouldn't it be sufficient to put this on the Unsubscribe page, since that’s where you end up if you click the link, whether accidentally or on purpose?

I guess we could argue have a civil discussion about whether it's better to proceed directly to “You are now unsubscribed” (as soon as you reach the page) or to ask people to click Unsubscribe on the page. (Definitely no more than a single click, or users will have legitimate reason to be annoyed, like trying to cancel {utility / internet / service ad lib}.)

[explorador]

@kendo:

Our mail server is on dedicated hardware and it has never been compromised. All configurations for SPF, Dmarc, etc are 100%

I have several questions, not sure if all apply because I don't use Gmail for mail and personal data-interactions, or Google for hosting websites-services, but I do have Gmail for basic contact stuff (things force you to use).

Let's cover the basics.

- You can have your website hosted at "cheap-whateverhosting.what" or "ultra-expensivehosting.something", and manage your emails there, including sending emails from your own server but telling the mail prog "this is my mail: a@gmail".
- You can do the same, while configuring your server to use Gmail infrastructure for mail
- You can do the same, while hosting your website at some G place

There could be variations there.

The thing is, some options man using your web hosting provider IP, and you must check your IP or domain reputation to see if it's been listed on security websites as spam. Here, things depend on how your neighbors or the company treat the infrastructure. Based on experience, sometimes things can be clean, but the email must be sent from G servers using their infrastructure.

Otherwise, filters, email services, spam protection, or Gmail flags things badly. It's not the same as using hello@gmail and sending an email FROM gmail on your browser, VS sending an email from your webserver using that same account. Does the explanation make sense to you?

Yes, you can buy an specific fixed IP, this helps a lot as long as only you use that IP (but yeah, someone can report it as spam anyway), and yes, others can report IPs in RANGE, not specific numbers, but a whole range. I used to constantly check the IP and domain reputation for clients, but I got tired of it due to so many factors in play. At the end of the day, for clients, I provided a panel where all the notifications are sent. Regarding direct notifications on their mail? use a whitelist, but yeah, people have to add it (the address) manually, otherwise it won't work. There was another option, but I don't remember. I grew tired of dealing with this.

[Kendo]

"You are getting this email because you subscribed to XYZ email list for new email notifications/ newsletters/ offers/ whatever. If you wish to not get these any more, simply click <a....>unsubscribe</a> here. "

We have left the rails. My problem has nothing to do with managing a SUBSCRIBE list.

Scenarios:

1. Users signup for a demo account to access an SaaS portal and need to validate their identity by responding to an email, ie: grubs using [e-mail] do not get access intellectual property.

2. Users email from our contact form asking for advice - again wanting access to intellectual property.

3. Users have purchased software or service and waiting an email with login instructions or licence key (intellectual property).

Problem:

The emails we send in response to #1, 2 and 3 end up in their SPAM folder if they are using Gmail. Having used those Gmail addresses carelessly, they are no doubt inundated with SPAM. If they use Gmail's webmail they might one day check their spam folder, but if they are using a desktop mail client to get mail, then they will never know about their spam folder.

What I get is lots of complaints and abuse for not replying, and not delivering what the client paid for.

But is there any way to contact Google about any of their shortcomings?

No. We get 100s of emails from them telling us how wonderful they are, all sent from a no-reply-get-lost email address, and nothing in WMT for feedback or support.

As for their recommended and documented procedures, if it is not outdated, it falls under the category of get-lost-these-are-our-excuses.

[Brett_Tabke]

> we have left the rails

Oh - we are right in your wheelhouse on this one.

> managing a SUBSCRIBE list.

>We don't spam but do send notices

Which is a list that gets finger printed by google and classified as a subscribed list

Why stuff can end up defaulting to spamo:

• If enough people don't open an email you send that looks "form'ish" (title of email is most important), then google starts to dump you into the spam folder. (put peoples name in the email title)
  
• If enough people click the unsubscribe link, Google starts to dump you into the spam folder.
  
• Every email gets a 'fingerprint'. If Gmail matches those 'fingerprints' to enough users, that don't interact with the email, it gets dumped into the spam folder.
  
• If you send out notices that get finger printed and tracked, and you don't include an "unsubscribe" link, everything from your servers goes to spam.
  
  

[Kendo]

Are we are talking about spam filtering designed by the same people who cannot provide unadulterated search results?

[chewy]

I manage a Google Workspace account for hundreds of users - plus there's regular bulk email to some very large lists.

And we're in a business category considered extra risky. Put it this way - we're not exactly named in Maslow's hierarchy of needs, but we have VERY POPULAR (collectible) stuff that just keeps getting better and better.

Let's call them xyz.com.

We recently discovered we were getting spam-foldered with ANY email we sent and oddly it was just happening to a few. I knew that meant more who were not complaining.

Randomly I discovered these receiving clients were all hosted on Microsoft/Outlook email infrastructure and it appeared that Microsoft's spam filters were being seemingly 'oversensitive' to cause this to happen.

I was truly in the dark until I dusted off an old Hotmail account for a test account - and sure enough, any email from xyz.com would get instantly spam-foldered. Looking at the headers of the received "spam" (not as easy as it once was) I saw that MS's spam scoring system was embedded there and it clearly indicated not only what was wrong, but what the spam score actually was. Another random email account on a different host happened to include SpamAssassin which also did virtually the same thing but in a different fashion.

With these two systems I was able to understand what the problem was and what to do and why - and no more spam-foldering.

Now, we get perfect scores.

And I get tons of DMARC Aggregate Reports that I routinely run through ChatGPT to figure out if we're having issues. It helped me write a Python script to help handle them in bulk. So far so good - no issues reported.

One of the things we did was to create mail.xyz.com and use that exclusively with bulk email (MailChimp) and so far things are looking good. Complaints have dropped to zero.

Advice for receivers to whitelist xyz.com has not been sent out. I hope we never have to do that.

One of the things that seemed to help was cleaning out a too-long SPF record. Flattening didn't seem to be working somehow, so removing most of the domains seemed to be extremely helpful. Most were moved to the mail.xyz.com and we got some guidance from MailChimp as to how to handle their revolving door IP addresses. Also we corrected DKIM execution with them. These too seemed to help a lot.

We'll see how things go.

[Kendo]

To better understand how Google's SPAM score works, add your domain to [postmaster.google.com ]

It will take a while before data can be collected to be assessed.

One thing that I noticed with one of our domains was that DKIM and SPF were flagged as needing attention. Yet all other mail testers pass it 100%. Digging deeper I found that it was flagged because Gmail was not included in SPF. Well we have never ever tried to use Gmail to email our client base. In any case, wouldn't adding Gmail to SPF enable everyone using Gmail to spoof using our domain as the sender to ruin our reputation?

But it gets dumber.

Apparently their spam threshold is 0.03%

That means that all it takes for you to be flagged is 3 out of 1,000 recipients to flag your email as spam!

[Kendo]

Their spam threshold is actually 0.3% which is still 3 in 1,000.

This means that it only takes 1 of every 100 recipients to mark your message as spam to ruin your reputation.

[lucy24]

it only takes 1 of every [300] recipients to mark your message as spam

Has G### never heard of a margin of error? 3 in 1000 is within the margin of cat stepping on keyboard.

[ichthyous]

Quick tip, if you open email as source in Gmail panel it will give you information about valid/invalid DKIM, SPF and DMARC.

I have all that set up for years, but my emails also go to my customers spam. Its so bad that I have taken to texting them that I emailed a price quote so they are aware. Meanwhile, Google lets through the most obvious spam into my inbox all the time, and blocks the emails sent from my websites contact form completely or marks it as spam matter how many times I say it isn’t. Gmail is a mess...much worse than it used to be in my experience

[chewy]

...neglected to mention we use Proopoint as our outbound IP. Still no complaints. Knock on wood.

[lucy24]

Under the head of It Just Goes To Show*:

Earlier today, I found a piece of email sorted to the spam folder.
Sender: my utility company.
Subject line: Protect Yourself Against Utility Scams.

Ay-yup.

* Not sure what it goes to show, but it definitely goes to show something.

[tangor]

Alas, I fear that AI* has been instructed to handle spam on the mail networks.

^{*Hallucinations, anyone?}

[Kendo]

More than 50% of the mail I get in my Gmail account is from Google.

Yet i don't see any of their mail in the "spam" folder or the new "promotions" folder which seems to get a lot of mail these days.

[clairemiso299]

A full inbox meter on the recipient side is common with Gmail lately and it pushes more borderline mail into spam without showing a clear reason. Even with perfect SPF and DMARC, Gmail still scores the sending pattern, content, and engagement. Low reply rates hurt that score fast. Adding a simple domain warmup sequence, sending shorter transactional style messages, and rotating a second sending domain often fixes deliverability. Checking if your IP is shared anywhere in old blocklists also helps because Gmail still uses those signals quietly even when other providers ignore them.