iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If SPF, DKIM and DMARC all passed but Gmail put your email in spam, authentication is not the whole story. Those checks help show that a message is authorized and, for DMARC, aligned with its visible sender domain; they do not prove recipients want the message or guarantee inbox placement. Gmail also considers sender and IP reputation, recipient spam reports, sending patterns and other signals.
Use Google Postmaster Tools to narrow down what is happening, then check alignment, list quality, unsubscribe handling and sending behavior. Without the message headers and your account-specific delivery data, there is no way to identify one certain cause.
What “passed” does—and does not—tell you
SPF and DKIM authenticate aspects of a message: SPF checks whether a sending server is authorized for a domain, while DKIM verifies a cryptographic signature associated with a domain. DMARC checks whether the visible From domain aligns with an authenticated SPF or DKIM domain and applies the domain owner’s policy. Passing those checks makes a message less likely to be rejected or marked as spam, but it does not guarantee that Gmail will place it in the inbox. Google’s Email sender guidelines address authentication alongside reputation, user-reported spam, sending behavior and other delivery requirements.
Free tools Windows power users keep installed
One-click scans. No signup required.
Also distinguish passing the three mechanisms from passing DMARC alignment. For bulk mail sent to personal Gmail accounts, the visible From organizational domain must align with the SPF or DKIM organizational domain. Google recommends aligning both; either one can satisfy the alignment requirement. A test that reports SPF and DKIM as passing does not, by itself, show whether the domains align on the message that landed in spam. Check the actual message and each sending service or mail stream.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
First, confirm what happened to the message
A message in Gmail’s spam folder is different from a rejected message, a temporary deferral or a bounce. Check the recipient’s Gmail folder and, if available, inspect the message details and the sending system’s SMTP response. Postmaster Tools can report delivery errors as well as authentication and reputation data, but it cannot diagnose a particular message without the relevant headers and account-specific information. Google describes the available dashboards in its Postmaster Tools dashboards guidance.
Use Postmaster Tools to look for a pattern
Google Postmaster Tools can show spam rate, domain and IP reputation, authentication and delivery errors for mail sent to personal Gmail accounts. Start by verifying your domain and reviewing these dashboards for the affected sending domain and IP. The data is scoped to personal Gmail recipients, and low sending volume can limit what appears, so an empty or sparse dashboard is not proof that delivery is healthy.
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Pay particular attention to the spam-rate dashboard. Google recommends keeping the reported spam rate below 0.10% and advises senders to avoid 0.30% or higher. These are Google’s current operational recommendations, not a guarantee that a particular rate will produce inbox delivery. Google says maintaining a high spam rate leads to increased spam classification. After corrective action, allow up to seven days for the dashboard rate to reach a level within compliance; that is a monitoring window, not a promise that inbox placement or reputation will recover on a fixed schedule. See Google’s dashboard troubleshooting guidance and sender guidelines.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsCheck the actual message’s alignment
- Identify the visible From domain. Use the address recipients see, not only the sending provider’s account or return-path domain.
- Inspect the authentication results for the affected message. Compare the SPF-authenticated domain and DKIM signing domain with the organizational domain in From.
- Confirm DMARC alignment. For bulk sending to personal Gmail accounts, at least one of SPF or DKIM must align with From; Google recommends aligning both.
- Repeat the check for every stream. A newsletter platform, transactional service and support system may authenticate differently. Verify the message that went to spam rather than assuming your primary provider represents every sender.
Google’s Email sender guidelines and sender guidelines FAQ explain the alignment requirement and bulk-sender rules.
Rank #3
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
Review who receives your mail and how they respond
Authentication cannot compensate for a list that generates spam complaints or contains people who no longer want your messages. Google recommends sending to people who want the mail, confirming addresses, periodically reconfirming subscriptions, making unsubscribe easy and considering removal of recipients who do not engage. Frequent spam reports can lower domain reputation and make future messages more likely to be classified as spam.
- Send to people who explicitly opted in; do not treat a purchased or scraped address list as consent.
- Confirm addresses and remove invalid or stale recipients.
- Make it easy to unsubscribe, and honor the request promptly.
- Consider suppressing recipients who have stopped engaging, especially before a large campaign.
Google does not track open rates and says it cannot verify the accuracy of open-rate figures reported by third parties. Do not use an open-rate benchmark as evidence of Gmail’s own assessment of your mail.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check which Gmail sending requirements apply
Google says its requirements for mail to personal Gmail accounts began on February 1, 2024. All senders must meet baseline technical requirements, including SPF or DKIM authentication, valid forward and reverse DNS, TLS, and keeping Postmaster Tools spam rates below 0.3%. Separately, Google’s stronger operational recommendation is to stay below 0.10% and avoid reaching 0.30% or higher.
Senders that send 5,000 or more messages in a day to Gmail accounts must set up SPF, DKIM and DMARC, align the From domain with SPF or DKIM, and support one-click unsubscribe for marketing and subscribed messages, with a visible unsubscribe link in the message body. Google’s FAQ, accessed October 7, 2026, says enforcement against non-compliant traffic began ramping up in November 2025; non-compliant messages may face temporary or permanent rejection. Only bulk senders that meet all relevant guidelines, including spam-rate and unsubscribe requirements, are eligible for mitigation. Read the current Email sender guidelines and FAQ for the applicable details.
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Look for abrupt volume changes or reputation problems
Google advises sending consistently, starting with engaged recipients, increasing volume gradually and avoiding sudden spikes. If you change infrastructure or headers, ramp the modified traffic separately rather than making a sharp increase across all mail at once. For deferrals or bounces, reduce volume until SMTP errors fall, then increase gradually.
Shared IP reputation matters, too: Google says activity from other senders on a shared IP can affect that IP’s reputation and therefore other senders using it. If you use a third-party sending provider, verify that it follows Google’s guidelines and that all senders are included in SPF. Google does not guarantee that mail sent through a provider will pass Gmail’s filters.
Quick Recap
A practical order for troubleshooting
- Classify the failure. Establish whether Gmail put the message in spam, rejected it, deferred it or returned a bounce.
- Review Postmaster Tools. Check spam rate, domain and IP reputation, authentication and delivery errors, keeping in mind the dashboards cover personal Gmail recipients and may lack data at low volume.
- Verify alignment on the affected message. Compare From with the SPF and DKIM organizational domains, and repeat for each service or stream.
- Audit acquisition, consent and response. Confirm recipients opted in, remove invalid or disengaged addresses, and provide effective unsubscribe handling.
- Check bulk-sender requirements if applicable. Confirm the applicable authentication, alignment, DNS, TLS and unsubscribe requirements are met.
- Review volume and infrastructure. Avoid bursts; reduce volume when delivery errors rise, then resume gradual increases.
- Monitor after changes. Track the dashboards and delivery results. Google says a spam-rate improvement may take up to seven days to appear within compliance, but does not promise a precise recovery date.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
