How the Gmail spam filter works: what it checks, in the order it checks

Follow one message from your sending platform to a Gmail inbox and it passes through a sequence of gates, each capable of ending the journey. The connection itself is inspected before a single byte of your content arrives. Authentication is evaluated next, then the reputation attached to your domain and IP, and only after all of that does Gmail's content-and-engagement machinery weigh in. By the time your subject line gets read by a model, most of the filtering decision has already been shaped by things that have nothing to do with what you wrote.

That ordering is the most useful thing to understand about the Gmail spam filter, because it tells you where to look when placement goes wrong — and it's usually not where senders look first.

Stage one: the connection

Before content, Gmail evaluates the machine that's talking to it. Per Google's sender guidelines, sending servers need a valid reverse DNS record — a PTR record that resolves the sending IP back to a hostname which resolves forward to the same IP — and the connection must use TLS. Mail that fails these checks can be rate-limited or rejected before the message body is even transmitted; Gmail's published error codes include responses specifically for missing PTR records and non-TLS connections. The full register of these requirements, with the error codes Gmail returns for each, is in our Gmail sender requirements page.

For most senders on an established platform, this stage is invisible — the platform's infrastructure handles it. It becomes relevant when you run your own SMTP server, or when a misconfigured subdomain starts sending outside the platform's managed path. A quick pass through the reverse DNS checker confirms the PTR side.

Stage two: authentication

Next, Gmail asks whether the message can prove who sent it. It evaluates SPF, DKIM and DMARC, and writes its conclusions into the Authentication-Results header of every delivered message — which means you can read Gmail's own verdict on your mail by sending to a Gmail address you control and pasting the raw source into an email header analyzer.

Since Google's bulk sender requirements took effect in early 2024, authentication has been an entry condition rather than a bonus. All senders need SPF or DKIM at minimum; senders of 5,000 or more messages a day to personal Gmail accounts need SPF, DKIM and a published DMARC policy, with the From domain aligned to one of them. Unauthenticated bulk mail doesn't get quietly downranked anymore — it gets rejected with an error code that says so.

Authentication doesn't earn inbox placement. It establishes identity, which is what allows the next stage to work at all.

Stage three: reputation

Once Gmail knows who you are, it consults what it remembers about you. This is where the filter does most of its discriminating, along two tracks it reports separately in Postmaster Tools: domain reputation — the history attached to your authenticated domain — and IP reputation, the history of the sending address itself. Google describes both as bands (bad, low, medium, high) rather than scores, and both are built from how Gmail users have reacted to your past mail.

The single heaviest input, per Google's own documentation, is the user-reported spam rate: the share of your delivered mail that recipients mark as spam. Google's stated thresholds are concrete — stay below 0.3% always, and aim to stay under 0.1%. A sender whose rate crosses 0.3% loses eligibility for mitigation until it has stayed back under the line for a sustained period. Those numbers come from Google's Postmaster Tools documentation, and they are the closest thing the Gmail filter has to a published rulebook.

Reputation explains the phenomenon that confuses senders most: the same message, byte for byte, landing in one user's inbox and another user's spam folder — or sailing through for one sender and getting buried for another. The filter isn't primarily judging the message. It's judging the track record of the identity behind it.

Stage four: content and engagement models

Only now does the message itself get read. Gmail's content filtering is machine-learning driven and personalized — Google has said its systems weigh signals per recipient, which is why a sender your users consistently open behaves differently from one they ignore, even at identical reputation.

What the models penalize is, broadly, resemblance to what users report: phishing-shaped patterns like mismatched link text and destinations, image-only messages with minimal text, deceptive subject lines, and link domains with poor histories. What they reward is harder to game, because the strongest positive signals are recipient actions — opens, replies, moves out of spam, adds to contacts — that accumulate into the reputation consulted in stage three. Content and reputation aren't separate systems so much as fast and slow loops of the same judgment.

This is also why word-level spam-trigger folklore ("free", "act now", all caps) has aged badly. A trusted sender survives clumsy copy; a distrusted one gets filtered writing plain prose. We walk through that ranking of causes in why emails go to spam.

What you can actually influence

Laid against the pipeline, the levers rank themselves:

1. Pass every gate you control outright. Authentication and infrastructure are pass/fail and fully yours. The email deliverability score checks the whole setup layer in one run.
2. Manage the spam-rate number Google tells you to manage. Register your domain in Postmaster Tools before you have a problem; it only accumulates data forward. Keep unsubscribing painless — one-click unsubscribe is mandatory for bulk senders anyway — so annoyed recipients leave instead of reporting.
3. Send mail people demonstrably open. Engagement is the input to every model downstream. Suppressing chronic non-openers raises the average reaction to your mail, which is the quantity Gmail is actually measuring.
4. Keep your sending pattern steady. The filter models your normal volume and cadence; sharp deviations read as anomalies.

There is no fifth lever. Techniques marketed as filter evasion — text obfuscation, zero-width characters, rotating domains — are the patterns the models are explicitly trained on, and we don't publish workarounds. The filter is built to reward wanted mail, and the only durable strategy is to be measurably wanted.

When Gmail placement drops anyway

Work the pipeline in order. Confirm authentication from a real header, not a dashboard. Check both reputation bands in Postmaster Tools and the spam-rate trend over the last 90 days, not the last send. Only when those come back clean is content testing worth your time. And if you're choosing a sending platform partly on Gmail performance, our Gmail placement ranking is where we publish measured Gmail placement for the major platforms as each test cycle completes.

Related guides

• Gmail sender requirements — the enforced rules, thresholds and error codes, verified against Google's documentation
• Email deliverability score — test the setup layer of the pipeline in one pass
• Email header analyzer — read Gmail's authentication verdict on your own mail
• Why emails go to spam — the seven causes, in checking order
• Domain reputation — the memory the filter consults first
• Complaint rate — the number behind the 0.3% ceiling

About this guide

Written by InboxRatio Editorial. Gmail does not publish its filter's internals; this guide describes the pipeline as far as Google's sender guidelines, Postmaster Tools documentation and published error codes define it, and labels everything beyond that as inference from observed behavior. No vendor sponsorship influences it.

Methodology

InboxRatio's benchmark sends real campaigns through the platforms we review to a controlled seed list that includes Gmail mailboxes, and records where each message lands. This guide draws on Google's published documentation rather than our measurements; the testing protocol is documented in how we test and our source rules in sources.

Last updated

30 August 2026. Requirements and thresholds are reviewed quarterly against Google's current sender documentation.

Frequently asked questions

How does the Gmail spam filter decide what goes to spam? In layers: connection checks (TLS, reverse DNS), authentication (SPF, DKIM, DMARC), sender reputation built mostly from user spam reports and engagement, and finally personalized content models. Reputation carries the most weight for established senders; authentication failures can end the journey before content is ever evaluated.

Why do my emails go to spam in Gmail but not Outlook? Each provider runs its own filter on its own data. Gmail weighs its users' reactions to your mail; Microsoft weighs its users'. Different histories produce different verdicts on identical messages. Check Postmaster Tools for the Gmail-specific view before assuming a global problem.

Does Gmail have a spam filter sensitivity setting? Not for senders, and effectively not for individual users either — recipients can create filters and mark senders as safe, but there is no global sensitivity dial. Workspace administrators do get policy controls for their own organization's inbound mail.

Can I ask Google to fix my spam placement? Google provides a sender contact form for bulk senders, but per its own documentation, mitigation is unavailable while your user-reported spam rate is at or above 0.3%. In practice the path is: fix the cause, hold the rate down, and let the reputation system re-score you.

Do spam trigger words still matter in Gmail? Far less than folklore claims. Content signals are real but sit downstream of reputation, and modern models evaluate whole-message patterns rather than keywords. If authenticated, well-received mail is landing in spam, the cause is almost never a single word choice.

How do I check what Gmail thinks of my domain? Register the domain in Google Postmaster Tools for reputation bands and measured spam rate. For the setup layer, run it through the email authentication checker and read a real delivered message's headers.

The pipeline runs in one direction, so debug it in the same direction: connection, authentication, reputation, content — and before any of that, confirm the layer you fully control by running your domain through the email deliverability score.