Google Workspace SPF DKIM DMARC All Pass but Emails Still Go to Spam

You check message headers and SPF passes, DKIM passes, DMARC passes. Everything is green. But your cold emails are still landing in spam on Gmail. This is the most frustrating deliverability problem because it feels like the rules are broken.

Why this happens

Authentication is a gate check, not a quality score. Passing SPF, DKIM, and DMARC tells Gmail the email is legitimately from your domain. It does not tell Gmail the email is wanted. Think of authentication as showing your ID at the door — it proves you are who you claim to be, but it does not mean you are welcome at the party.

Gmail uses hundreds of signals beyond authentication to decide inbox placement. The most important for cold email senders are domain reputation, IP reputation, engagement history, content signals, and complaint rates.

What's typically going wrong

• Domain reputation is Low or Bad. A new domain or a domain with limited positive engagement history does not get the benefit of the doubt. Check Google Postmaster Tools — reputation levels are High, Medium, Low, or Bad. Low or Bad overrides clean authentication every time.
• Sending IP reputation is poor. If you are on a shared IP, other senders on that same IP may have damaged its reputation.
• Spam complaint rate is too high. Google's threshold is 0.3%, but 0.10% is already the danger zone. Even a small percentage of recipients marking your emails as spam poisons the well for all future sends.
• Content looks like spam. Certain patterns trigger content-based filtering regardless of authentication: excessive links, tracking pixels from shared domains, URL shorteners, certain word combinations, HTML structures that resemble known spam templates.
• No positive engagement signals. Gmail weighs opens, replies, clicks, and whether recipients move your messages out of spam or add you to contacts. A domain with authentication but zero engagement history is still suspicious.

Step-by-step diagnosis

Step 1: Check Postmaster Tools

Go to postmaster.google.com and check domain reputation, IP reputation, and spam rate. If domain reputation shows Low or Bad, that is your answer. If spam rate is above 0.10%, that is contributing directly.

Step 2: Run a blacklist check

Run your domain and sending IPs through the blacklist checker. A blocklist hit will override clean authentication on many providers.

Step 3: Send a plain text test

Send a plain text email to a Gmail account you control — no links, no tracking, no HTML. Just two sentences. If it lands in the inbox, your authentication and reputation are probably fine and the problem is your content. If even plain text goes to spam, the issue is domain or IP reputation.

Step 4: Check your tracking domain

Use the tracking domain checker. A tracking domain proxied through Cloudflare (orange cloud enabled) or on a shared reputation domain is one of the most common silent spam triggers.

The fix path

If domain reputation is the problem, you need to rebuild it. Reduce volume dramatically. Send only to contacts who are most likely to engage. Every open and reply you generate is a positive signal. Stop all cold outreach to unengaged lists until reputation improves. This takes 2–4 weeks of consistent positive signals.

If spam rate is too high, add proper one-click unsubscribe headers immediately. Remove any recipients who have not engaged in previous campaigns. Better targeting is the long-term fix.

If content is the trigger, simplify. Go plain text. Remove all links except one. Write shorter messages — under 100 words. Make them conversational rather than formatted like a newsletter.

If IP reputation is the issue and you are on a shared IP, you either need a dedicated IP or different sending infrastructure. If you route through a third-party outreach tool, check their IP reputation separately from your GWS domain.

Repair or replace?

If Postmaster Tools shows domain reputation as Low and you have been sending for less than a month, you can likely repair it by pulling back volume, cleaning your list, and generating positive engagement over 2–3 weeks.

If domain reputation shows Bad and spam rate has been above 0.3% for more than a week, repair is possible but slow — 4–8 weeks of disciplined low-volume sending with high engagement.

For agencies with active client campaigns that can't wait, the practical move is to rotate in clean, prewarmed inboxes from a service like WarmInboxes. That lets the damaged domain rest and rebuild while outreach continues uninterrupted on healthy infrastructure.