Gmail Spam Filter 2026: 35 Mail Failures
Most teams fix SPF and stop. Gmail scores 35 signals before inbox placement. Here is each failure and the fix.
Your ESP dashboard says "delivered." Gmail says spam. Same campaign, same list, two different realities. Last month we traced a 14-person B2B SaaS team in Berlin whose password resets hit spam at 41% while their weekly newsletter "passed" authentication. Google Postmaster showed a clean domain reputation. SPF returned pass. The problem was not one record. It was six stacked failures: DMARC alignment on the transactional subdomain, a missing List-Unsubscribe header on product mail, and a PTR record on their Microsoft 365 egress that did not match the HELO name. Look, the gmail spam filter 2026 stack is not a single yes/no gate. Gmail's filtering pipeline (documented in Google's Email Sender Guidelines, updated for bulk senders in February 2024) evaluates authentication, DNS hygiene, encryption, complaint rates, engagement signals, and header compliance before it decides inbox vs. Promotions vs. Spam. Microsoft enforces a parallel set through Outlook.com and Exchange Online Protection. If you only check SPF in DNS and call it done, you are auditing maybe 15% of what actually moves mail.
The Real Cost of Getting This Wrong
Revenue you cannot see on a dashboard
Return Path's 2024 deliverability benchmark (updated annually; 2025 edition showed similar ranges) found roughly 17% of permission-based commercial mail never reaches the inbox globally. For transactional mail (receipts, resets, shipping notices), even a 5% spam-folder rate on a $80 average order value adds up fast: 10,000 receipts/month × 5% lost × $80 = $40,000/month in customers who never saw the confirmation.
Compliance pressure in 2026
Google and Yahoo require SPF, DKIM, and DMARC for bulk senders (5,000+ messages/day to Gmail or Yahoo addresses) since February 2024. Spam complaint rates must stay below 0.3%. One-click unsubscribe is mandatory on marketing mail. PCI-DSS v4.0 (Requirement 4.2.1, effective March 2025) expects TLS for transmission of cardholder data, which ties directly to MTA-STS posture on inbound mail paths.
Why Fixing SPF Alone Still Lands You in Spam
SPF answers one question: is this sending IP authorized to send for this domain? Gmail's filter asks a dozen more.
Alignment beats existence
You can publish a valid SPF record and still fail DMARC alignment when your From: header uses a different domain than the SPF-authenticated envelope (common with Mailchimp, HubSpot, and Shopify Email). Gmail treats that as spoofing risk even when SPF returns pass.
Reputation is not DNS
A clean DNS audit does not fix a 0.4% spam complaint rate or a list purchased in 2019. Google's Postmaster Tools domain reputation (Bad, Low, Medium, High) reflects user complaints and engagement, not TXT records.
We've seen teams skip PTR/FCrDNS checks entirely because "we use Google Workspace and don't control the IP." You still inherit whatever reputation and reverse-DNS match that shared pool carries.
“SPF pass is a participation trophy. Inbox placement is alignment, encryption, reputation, and headers working together.”
Authentication Failures (#1-12)
Fix these first. Gmail's 2024 sender requirements treat SPF, DKIM, and DMARC as baseline, not optional.
- Missing SPF record - Publish
v=spf1at the root domain. For Microsoft 365:v=spf1 include:spf.protection.outlook.com -all. For Google Workspace:v=spf1 include:_spf.google.com -all. - SPF permerror (too many DNS lookups) - Gmail and most receivers reject permerror as fail. Flatten includes or remove dead ESP entries. Stay under 10 DNS lookups (RFC 7208).
- SPF softfail (~all) on a sending domain - Use
-all(hardfail) on domains you actively send from. Softfail is a weak signal in 2026. - SPF present but not aligned with From: - Enable envelope-from alignment or configure your ESP to sign with your domain. Check
aspf=sin DMARC if you rely on strict SPF alignment. - Missing DKIM signature - Enable DKIM in your ESP or mail server. Publish the public key as a TXT record at
selector._domainkey.yourdomain.com. - DKIM fail after key rotation - Publish the new selector before retiring the old key. We've had teams rotate in Microsoft 365 admin and forget the DNS TXT for 48 hours.
- DKIM body hash modified in transit - Mailing list managers, "forward this email" links, and some CRM footers rewrite HTML and break the body hash. Test with a raw send, not a template preview.
- Missing DMARC record - Publish at
_dmarc.yourdomain.com. Start with monitoring:v=DMARC1; p=none; rua=mailto:[email protected] - DMARC p=none forever - Monitoring-only policy gives Gmail no enforcement signal. Move to
p=quarantinethenp=rejecton a staged rollout. Strict alignment is overrated for most SMBs; relaxed alignment with a real policy beats p=none with adkim=s. - DMARC alignment failed (SPF or DKIM not aligned) - Run a test send and inspect Authentication-Results headers. Fix the failing leg before touching policy.
- Broken ARC chain on forwarded mail - Forwarding breaks SPF. ARC (Authenticated Received Chain) preserves auth results through forwarders. Enable ARC signing if you operate a forwarding gateway; otherwise use SRS or dedicated subdomains for forwards.
- No BIMI record (trust signal gap) - BIMI does not fix spam by itself, but Gmail requires DMARC enforcement (quarantine or reject) plus a VMC for logo display. Missing BIMI means you leave brand trust on the table after you fix auth.
DNS and Infrastructure Failures (#13-22)
Gmail checks whether your domain looks like it is operated by someone who maintains infrastructure, not just marketing DNS.
- Missing or wrong MX records - No MX means undefined mail routing. Single MX with no secondary means no failover during provider outages.
- PTR / FCrDNS mismatch - Sending IP reverse DNS must resolve forward-confirmed rDNS. Shared pools on cheap ESP tiers often fail this on dedicated IP tiers only.
- No MTA-STS policy - Without MTA-STS, inbound mail to your domain can downgrade to cleartext SMTP. Google recommends MTA-STS for senders handling sensitive mail. Publish DNS + HTTPS policy file.
- Missing TLS-RPT - You cannot see when TLS fails on inbound delivery without
_smtp._tls.yourdomain.comreporting. Blind spots become silent spam triggers on misconfigured relays. - Domain on DNS blocklist (RBL) - Check major lists (Spamhaus, Barracuda, SORBS). Delist before scaling volume. One blacklist listing can override perfect SPF.
- Sending IP on blocklist - Dedicated IP users: check the IP separately from the domain. Shared IP: your neighbor's spam campaign is your problem.
- Open DNS resolver exposed - Open resolvers on infrastructure tied to your domain signal poor ops hygiene. Not a direct Gmail rule, but correlates with abuse scoring.
- Expired domain or SSL on mail-related hosts - MTA-STS policy files served over expired HTTPS certs fail validation. Domain expiry kills every record at once.
- Subdomain takeover via dangling CNAME - An abandoned
email.oldvendor.comCNAME lets an attacker host SPF-passing mail on your subdomain. Audit CNAME targets quarterly. - Weak DNSSEC or missing CAA - DNSSEC prevents DNS spoofing of your auth records. CAA restricts who can issue SSL certs for your domain. Both reduce takeover and MITM risk on mail infrastructure.
Reputation and Sending Behavior (#23-29)
These failures live outside DNS. Gmail Postmaster Tools is where you see them.
- Spam complaint rate above 0.3% - Google's bulk sender threshold (2024 guidelines). Above this, filtering tightens regardless of SPF pass. Scrub complainers immediately.
- High hard-bounce rate - Sending to dead addresses signals purchased or stale lists. Keep hard bounces under 2% per campaign (industry norm cited by M3AAWG best practices).
- Volume spike without IP/domain warm-up - Jumping from 500 to 50,000/day on a cold domain triggers rate limits. Ramp over 2-4 weeks.
- Low engagement (no opens/clicks) - Gmail uses engagement as a relevance signal. Dead segments drag domain reputation down for active subscribers too.
- Postmaster "Bad" or "Low" domain reputation - Fix auth and complaints first, then wait 2-4 weeks for reputation recovery. There is no DNS record for this.
- New domain with no sending history - Greenfield domains get scrutinized harder. Send consistent low volume to engaged users before marketing blasts.
- Shared IP pool with abusive neighbors - Budget ESP tiers put you on IPs with casino and pharma mail. Dedicated IP or a tier with stricter onboarding helps (not a guarantee).
Content, Headers, and List Hygiene (#30-35)
Google's February 2024 bulk sender rules made several header requirements enforceable, not optional.
- Missing List-Unsubscribe on bulk mail - Marketing and promotional mail needs
List-Unsubscribeand one-click unsubscribe (RFC 8058). Gmail rejects or spam-folders non-compliant bulk senders. - From: domain mismatch with visible brand - Sending from
mail.otherdomain.comwhile displaying Acme Corp confuses users and triggers phishing heuristics even when auth passes. - Broken or missing Reply-To on transactional mail - Password resets with
noreply@and no support path increase "report spam" clicks from frustrated users. - Spam-trigger HTML patterns - Image-only emails, excessive exclamation marks, red font on white, and URL shorteners in bulk mail still score in content filters (secondary to auth, but real).
- Attachment types flagged by Gmail - .exe, macro-enabled Office files, and certain archive types get quarantined. Use hosted download links for software.
- No suppression list hygiene - Continuing to mail unsubscribes and spam reporters guarantees complaint rate failure. Sync ESP suppressions with CRM nightly.
How to Audit All 35 Signals in One Pass
Export Gmail Postmaster Tools data (spam rate, domain reputation, authentication pass rates) for the last 30 days. If you have not verified the domain yet, add the TXT record Google provides.
Run DNS lookups from an external resolver (not your laptop cache): dig TXT yourdomain.com for SPF, dig TXT _dmarc.yourdomain.com for DMARC, dig TXT default._domainkey.yourdomain.com for DKIM. Compare to what your ESP admin panel claims is published.
Send a test message to a Gmail account you control. Open "Show original" and read Authentication-Results. You want spf=pass, dkim=pass, dmarc=pass on the same From: domain.
In Cloudflare (or GoDaddy, Route53), add missing records from your audit. For M365 DKIM: Admin center → Settings → Domains → DKIM → publish both CNAME selectors before enabling signing.
Check blocklists at zerohook.org/dns-visualizer or your monitoring tool. Delist any hits before the next bulk send.
Review the last 3 campaigns: complaint rate, bounce rate, unsubscribe rate. Pause marketing if complaints exceed 0.2% until DNS and list fixes land.
Schedule a weekly re-scan. DNS drift (expired DKIM keys, ESP adds a new include) breaks mail silently.
What a full audit covers vs. a quick check
| Check type | Free tier (6 checks) | Paid 35-check audit |
|---|---|---|
| SPF / DKIM / DMARC basics | Yes | Yes |
| SPF lookup limit, strictness | No | Yes |
| MTA-STS, TLS-RPT, BIMI, ARC | No | Yes |
| Blacklist, PTR, FCrDNS | Partial | Yes |
| Subdomain takeover, open resolver | No | Yes |
The full checklist mapped to each audit point lives at zerohook.org/audit-checklist if you want to see what each check validates before you run one.
Frequently Asked Questions
Does Gmail still use SPF in 2026?
Yes. SPF is required for bulk senders under Google's 2024 guidelines.
My mail passes SPF and DKIM but still goes to spam. What is the most common cause?
DMARC alignment failure or a reputation problem. Open Authentication-Results on a spam-foldered message. If dmarc=fail, alignment is broken even when spf=pass and dkim=pass. If dmarc=pass, check Postmaster domain reputation and complaint rate. We usually see alignment issues on ESP relay mail within the first hour of debugging.
How long after fixing DNS does Gmail inbox placement improve?
Authentication fixes can show in Postmaster within 24-72 hours once Google re-crawls your DNS. Domain reputation recovery after high complaints often takes 2-4 weeks of clean sending to engaged users. There is no instant reset button.
Do I need all 35 fixes if I only send transactional email?
No. Transactional senders can prioritize #1-12 (auth), #13-14 (MX/PTR), #30-32 (headers), and #23-27 (reputation). Bulk marketing senders need the full set including List-Unsubscribe and warm-up discipline.
Is p=reject safe for a small business?
With a staged rollout (p=none → pct=25 quarantine → full quarantine → reject over 6-8 weeks) and aggregate report monitoring, yes. Jumping straight to p=reject without checking every legitimate sender (CRM, billing, helpdesk) is how teams block their own invoices.
Microsoft 365 and Gmail: same rules?
Mostly. Both require SPF, DKIM, and DMARC for bulk senders. Microsoft published parallel requirements in 2024 (BIMI support expanded in 2025). Outlook.com uses SNDS and Microsoft Postmaster for reputation, not Gmail Postmaster.
Key Takeaways
Key takeaways
Gmail's spam filter in 2026 evaluates 35+ signals: authentication alignment, DNS hygiene, encryption, reputation, and header compliance. SPF pass alone is never enough.
Fix authentication (#1-12) before reputation work. DMARC alignment failure is the top "everything passes but mail is spam" cause we see on ESP relay setups.
Google's 0.3% spam complaint ceiling and one-click unsubscribe rules (2024 bulk sender guidelines) are enforceable. DNS perfection cannot save a dirty list.
Audit DNS weekly. DKIM keys rotate, ESPs add SPF includes, and dangling CNAMEs appear when you cancel vendors.
Map DNS failures to revenue with your complaint rate and average order value before the next campaign goes out.
Run your domain through the free ROI calculator at zerohook.org/email-roi-calculator to estimate what spam-folder placement costs per month, then fix the DNS failures that stack behind a single "SPF pass."
Share this analysis
Help others discover this content
About the author
The ZeroHook Team publishes DNS and email security guides for IT managers who need fixes, not brochures.
