Google Workspace SPF, DKIM, DMARC All Pass but Emails Still Go to Spam
Everything is green in the headers. But Gmail is still burying your cold emails. Here's what's actually going on — and what to fix.
You check message headers and SPF passes, DKIM passes, DMARC passes. Everything is green. But your cold emails are still landing in spam on Gmail. This is the most frustrating deliverability problem because it feels like the rules are broken.
Why This Happens
Authentication is a gate check, not a quality score. Passing SPF, DKIM, and DMARC tells Gmail that the email is legitimately from your domain. It does not tell Gmail that the email is wanted. Think of authentication as showing your ID at the door — it proves you are who you claim to be, but it does not mean you are welcome.
What is typically going wrong when authentication passes but emails hit spam:
- Domain reputation is low or unknown. Check Google Postmaster Tools — it shows reputation as High, Medium, Low, or Bad. If yours is Low or Bad, that overrides clean authentication every time.
- Your sending IP reputation is poor. If you are on a shared IP, other senders on that same IP may have damaged its reputation.
- Spam complaint rate is too high. Google's requirement is to stay below 0.3% as reported in Postmaster Tools, with a target below 0.10%. Even slightly above triggers increased spam classification.
- Content triggers content-based filtering. Certain patterns trigger filters regardless of authentication: excessive links, tracking pixels from shared domains, URL shorteners, certain HTML structures.
- Low engagement signals. Gmail weighs opens, replies, and clicks. A domain with authentication but zero engagement history is still suspicious.
Step-by-Step Diagnosis
Check your Postmaster Tools data. Look at domain reputation, IP reputation, and spam rate. If domain reputation is Low or Bad — that's your answer. If spam rate is above 0.10%, that's contributing.
Run the blacklist checker on your domain and sending IP. A blocklist hit overrides clean authentication.
Send a plain text email to a Gmail account you control — no links, no tracking, no HTML. Just two sentences. If it lands in inbox, your authentication and reputation are probably fine and the problem is your content. If even plain text goes to spam, the issue is domain or IP reputation.
Run a placement test using your actual sending infrastructure. The headers in the result show exactly what the receiving server saw for each authentication check.
The Fix Path
If domain reputation is the problem: reduce volume dramatically. Send only to contacts most likely to engage. Every open and reply is a positive signal. Stop all cold outreach to unengaged lists until reputation improves. This can take 2–4 weeks of consistent positive signals.
If spam rate is too high: add proper one-click unsubscribe headers immediately. Remove any recipients who have not engaged in previous campaigns.
If content is the trigger: simplify. Go plain text. Remove all links except one. Use a custom tracking domain instead of your outreach tool's default shared tracking domain.
When to Replace Instead of Repair
If domain reputation shows Low in Postmaster Tools and you have been sending for less than a month, you can likely repair it by pulling back volume and generating positive engagement over 2–3 weeks.
If domain reputation shows Bad and spam rate has been above 0.3% for more than a week, repair is possible but slow — 4–8 weeks. For agencies with active client campaigns, the practical move is to rotate in clean, prewarmed inboxes from WarmInboxes. That lets the damaged domain rest and rebuild while outreach continues uninterrupted on healthy infrastructure.
Mistakes That Make This Worse
- Increasing volume to compensate for low reply rates — this accelerates reputation damage
- Ignoring Postmaster Tools data because "authentication passes"
- Continuing to send to the same list that is generating spam complaints
- Assuming the problem will fix itself without changing anything
Run the checks first
Before replacing anything, run a free inbox placement test. You might find the issue is DNS, not the domain — and save yourself a week of unnecessary work.