Gmail "This message seems dangerous" warning: sender fixes

Short answer

Gmail puts a warning on a message when it can't confirm who sent it, or when the message looks like phishing. On email you send, the usual causes are on your side: SPF and DKIM both fail, the message is authenticated for a domain that doesn't match your From address, your app sends with an @gmail.com From address, or the message carries links or attachments Gmail treats as risky.

Open an affected message in Gmail, choose Show original and check SPF, DKIM and DMARC. If any of them fails for your From domain, fix that first: it's the cause Google documents most clearly, and it's entirely in your control.

Which warning are you seeing?

Google doesn't publish the full wording of every banner, and the text changes over time. What its help pages do document is the checks behind them. Match what you or your user sees to the row below, then go to the cause.

What you see	What Google says about it	Usual cause on the sender's side
"Be careful with this message" (yellow banner)	Gmail warns when it can't confirm who sent a message. Google Workspace admins can also turn on protections that keep a message in the inbox with a yellow warning banner: mail not authenticated with SPF or DKIM, domains that look like the recipient's own, and display names that match someone in the recipient's company.	SPF and DKIM both failing, a From domain that doesn't line up with the authenticated domain, or a display name that looks like one of the recipient's colleagues. The line under the banner usually gives the reason.
"This message seems dangerous" (red banner)	"When we identify that an email may be phishing or suspicious, we might show a warning or move the email to Spam" (Gmail Help).	Something in the message looks like phishing: links to a domain with a poor reputation, a sending domain or IP with very low reputation, or content that reads like a credential grab. Gmail's own SMTP error list names the same three reasons a message can be suspicious: low IP reputation, low domain reputation, and "the nature of the content or the links within".
"This message may not have been sent by" `name@gmail.com`	Shown when a sender looks like `name@gmail.com` but the message doesn't have authentication data showing it was sent through Gmail (Gmail Help).	Your app puts a user's own `@gmail.com` address in the From line and sends it through your servers. See Gmail addresses in your From line.
A question mark instead of the sender's photo	"If you see a question mark next to the sender's name, the message isn't authenticated" (Gmail Help).	Neither SPF nor DKIM passes for the message.
via another domain next to the sender's name	"The domain it was sent from doesn't match the domain in the From: address" (Gmail Help).	Your provider signs or sends with its own domain instead of yours. Not a warning on its own, but it often turns up in the same screenshots.
In Spam, with a note that Gmail can't confirm who sent it, or that the address looks very similar to a known sender	Two of the reasons Google lists for mail marked as spam: messages from an unconfirmed sender, and spoofed addresses that look very similar to a known sender's.	Failed authentication, or a sending domain that looks like another one the recipient knows (`acme-mail.com` next to `acme.com`).

From Google's Gmail Help and Google Workspace admin help, linked in each row. Google can change banner wording without notice.

Why Gmail shows the warning on your email

Work down this list. The first three cover most transactional mail, and you can confirm or rule them out in a minute from the message headers.

1. The message isn't authenticated

If neither SPF nor DKIM passes, Gmail can't confirm the message came from your domain. That's the question mark, and Google Workspace's "Protect against any unauthenticated emails" setting requires messages to be authenticated with SPF or DKIM (or both). Common reasons: no SPF record, an SPF record that doesn't include your email provider, a DKIM record that was never published, or a key pasted with a typo. DKIM fail maps each DKIM failure reason to its fix.

2. It's authenticated, but not as your From domain

SPF and DKIM can both pass for your provider's domain while your own domain gets nothing. Then the header shows dkim=pass header.d=provider.example next to dmarc=fail header.from=example.com, and Gmail adds "via" to the sender's name. Google's advice for mail not sent through Gmail is to sign with a DKIM key for your domain, publish SPF for the servers that send for you, and "make sure the domain in the From: address matches the domain you're using to authenticate your emails".

3. A Gmail address in your From line

Apps that send "on behalf of" a user sometimes put the user's own address in From: jane@gmail.com, sent from your servers. That message can't pass DMARC for gmail.com, and it's exactly what the "may not have been sent by" warning is for. Google's sender guidelines say not to impersonate Gmail From headers.

Send from your own domain and put the user where replies should go: From: "Jane Smith via Acme" <notifications@acme.com> with Reply-To: jane@gmail.com. Sending email on behalf of your customers covers the setups that pass DMARC.

4. The message was forwarded

If the recipient auto-forwards from another address to Gmail, or your message went through a mailing list, SPF fails at Gmail because the forwarder's server isn't in your SPF record, and DKIM fails if the forwarder changed the message (a footer, a subject tag). Google lists automatic forwarding among the causes of the "may not have been sent by" warning. Mail you send directly isn't affected; a warning that only shows up for one forwarded mailbox is usually the forwarder's doing.

5. The display name looks like the recipient's colleague

Google Workspace can warn when the sender's name matches someone in the recipient's company directory but the email isn't from that company's domain. Invitation and comment emails that use the person's name alone as the display name ("Jane Smith" <notifications@acme.com>) fit that description when Jane works at the recipient's company. Google doesn't say exactly how it matches names, but naming your product in the display name, as in "Jane Smith via Acme", at least makes the real sender obvious.

6. Your sending domain looks like another domain

A separate domain for email, such as acme-mail.com or acmeapp-notifications.com, can look like an imitation of your main domain, and Gmail flags addresses that look very similar to a known sender's. Send from your main domain or a subdomain of it (notifications.acme.com), which carries your brand and can share its reputation.

7. Links and attachments

Links to a domain on a blocklist. If a domain you link to is listed on a domain blocklist, receivers treat the message as risky. That includes a click-tracking domain shared with other senders. Check your own domains with the blocklist checker.
Links that hide where they go. Google's sender guidelines ask for web links that are "visible and easy to understand". A sign-in link that goes through a URL shortener or a chain of redirects is harder to trust than a direct link to your own domain.
Encrypted or password-protected attachments. Google Workspace can warn on encrypted attachments from untrusted senders, because they can't be scanned for malware, and on documents with scripts. For statements and invoices, link to a page in your app instead.

8. A new domain or a sudden burst of mail

Google doesn't publish the signals behind its phishing warnings, but its own temporary errors say a message can be "suspicious due to the very low reputation of the sending domain" (or IP). A brand-new domain has no reputation yet, and Google's sender guidelines say to avoid sudden volume spikes and to increase volume slowly. Watch your domain in Google Postmaster Tools once you send enough mail to Gmail for it to show data.

How to check what's causing it

01Get a copy of an affected messageSend one to a Gmail address you control, or ask the user who saw the banner to forward it as an attachment. A normal forward replaces the headers you need.
02Open the originalIn Gmail on the web, open the message, select the three-dot menu and choose Show original. The summary at the top shows whether SPF, DKIM and DMARC passed, and which domain DKIM passed for.
03Read the Authentication-Results headerFurther down, the Authentication-Results header has the detail. Check that DKIM passed for your own domain (header.i=@acme.com or header.d=acme.com, depending on the receiver) and that DMARC passed for your From domain.
04Paste the headers into the analyzerThe email header analyzer pulls out each result, the domains involved and every server the message went through.

Authentication-Results: a message that gets a warning (example)

Authentication-Results: mx.google.com;
       dkim=pass header.i=@provider.example header.s=s1 header.b=Xk2f9qLm;
       spf=pass (google.com: domain of bounces@provider.example designates 203.0.113.25 as permitted sender) smtp.mailfrom=bounces@provider.example;
       dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=acme.com

Both SPF and DKIM passed, but for provider.example, not acme.com, so DMARC failed and Gmail shows "via provider.example". The same message once the provider signs and sends as Acme's domain:

Authentication-Results: authenticated and aligned (example)

Authentication-Results: mx.google.com;
       dkim=pass header.i=@acme.com header.s=s1 header.b=Pq7c2rTn;
       spf=pass (google.com: domain of bounces@rp.acme.com designates 203.0.113.25 as permitted sender) smtp.mailfrom=bounces@rp.acme.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=acme.com

Then check the domain itself with the free tools:

Domain health check: SPF, DKIM, DMARC and MX in one pass, with what to fix.
SPF checker, DKIM checker and DMARC checker: one record at a time.
Blocklist checker: your sending domain, your link domains and your sending IP.
Email spam test: send a real message and get every check a receiver runs, scored.

How to fix it

01Send from your own domainNever from an @gmail.com address or another domain you don't control. Put the user's address in Reply-To when replies should reach them.
02Publish one SPF record that includes your providerOne record per domain, with your provider's include:. Two SPF records on the same name make SPF fail for every message.
03Have your provider sign DKIM with your domainPublish the DKIM record it gives you so header.d= is your domain. Use a 2048-bit key where you can choose: Google treats messages signed with keys shorter than 1024 bits as unsigned.
04Add DMARC and check alignmentStart with v=DMARC1; p=none; rua=mailto:dmarc@example.com and confirm dmarc=pass on real messages before moving to quarantine or reject. SPF, DKIM and DMARC for transactional email has the full rollout.
05Clean up links and attachmentsLink directly to your own domain, turn click tracking off for sign-in and password reset emails, check your domains against the blocklists, and link to files rather than attaching encrypted ones.
06Name your product in the display name"Jane Smith via Acme" rather than "Jane Smith" alone, so the recipient can see who is really sending.
07Send a new message and check againGmail judges each message when it arrives. After a fix, send a fresh one and check Show original again rather than looking at the old message.

How Groundmail helps

When you add a domain, Groundmail gives you its DKIM, SPF, return path and DMARC records and checks each one on the domain page. Once they're live, every message is signed with your own domain's DKIM key, and the return path sits on your domain (rp.example.com), so SPF and DKIM both line up with your From address and Gmail has no reason to show "via" or a question mark.

Sign-in codes, password resets and receipts go out on their own IPs, kept separate from product and newsletter email. Free DMARC monitoring shows every server sending as your domain and whether it passes, so you can spot the one tool still sending unauthenticated mail.

If you received the warning

This page is for senders, but briefly: Google's advice is to avoid clicking links, downloading attachments or entering personal information when you see a warning, and to use Report phishing if you don't trust the message. For the "may not have been sent by" warning, Google says that if you know the sender is legitimate you can create a filter for their address with Never send it to Spam to stop the warning on their future messages. If the email came from a company you deal with, forward it to them as an attachment: the headers tell them what to fix.

Frequently asked questions

Does the warning mean my email went to spam?

Not necessarily. A banner can appear on a message in the inbox: Google Workspace's default for its spoofing protections is to keep the email in the inbox and show a warning. Gmail can also move a suspicious message to Spam instead, with a note saying why.

Why do some recipients see the warning and others don't?

Google Workspace admins choose which spoofing and attachment protections to turn on, so one company's users can see a banner that another's don't. Forwarding also differs per mailbox, and Gmail judges each message. If only one recipient sees it, check whether their mail is forwarded before changing your setup.

Will a DMARC policy of p=reject remove the warning?

No. A DMARC policy tells receivers what to do with mail that fails, which protects you from spoofers. It doesn't make your own failing mail pass. Fix SPF, DKIM and alignment first, confirm dmarc=pass on real messages, then tighten the policy.

How do I remove "via" next to my name in Gmail?

Make the domain that authenticates the message match your From domain: publish your provider's DKIM record for your domain and set up its return path on your domain. Google says the "via" appears when the domain it was sent from doesn't match the domain in the From address.

Can I make the warning go away on emails already delivered?

No. The fix applies to new messages. Send a fresh test after each change and check it with Show original.

Sources

Facts on this page about other companies' products, prices and policies come from these public pages. They change, so check them before you decide.