Gmail Says "This Message Seems Dangerous" on Your Emails: Causes and Fixes

Gmail shows "This message seems dangerous" or "Be careful with this message" when it suspects phishing or cannot confirm the message really comes from the sender it claims. For legitimate senders, failed or missing SPF, DKIM or DMARC is the most common cause, followed by risky links, unusual attachments and lookalike domains.

The banners exist to protect Gmail users, and they work: readers who see a red warning rarely reply or click. Here is how to find what triggered it.

The different warnings

Gmail uses several banners, and the wording changes over time. The common ones:

Banner	What Gmail is signalling
"This message seems dangerous" (red)	Strong phishing or malware suspicion
"Be careful with this message" (yellow or red)	Suspicious content, or similar messages were used to steal information
"Gmail couldn't verify that this email came from..."	Authentication failed or is missing
Question mark instead of sender photo	Message is not authenticated
"This message might be suspicious or spam"	Spam signals, often from content or sender history

The exact wording gives a clue. Anything mentioning verification points at authentication. Anything mentioning stealing information points at links or content.

Cause 1: Authentication failures

If Gmail cannot confirm that your domain sent the message, it may warn readers, especially if your domain has a DMARC policy or the message asks them to click or log in.

Check a received message with "Show original" in Gmail:

• SPF: PASS with your domain or your return-path domain
• DKIM: PASS with your domain
• DMARC: PASS

If any fail, fix them first. SPF, DKIM and DMARC explained covers the basics, and what is DMARC alignment explains why passes can still fail DMARC. The bulk email authentication checker checks your DNS records.

Common authentication problems behind warnings:

• A new sending tool that was never authenticated for your domain.
• An SPF record over the 10-lookup limit; check with the SPF lookup counter.
• DKIM keys that were rotated in the platform but not in DNS.
• Mail sent "from" your domain by a website form or plugin through an unauthenticated server.

Cause 2: Links

Links are a classic phishing tool, so Gmail inspects them closely.

• Link shorteners hide the destination. Avoid them in email.
• Mismatched link text, such as text showing one URL while the link goes to another, looks like phishing.
• Links to domains with poor reputation, including shared tracking domains used by many senders.
• Login or payment links in a message from an unauthenticated sender.
• Raw IP addresses in links.

Use a custom tracking domain on your own domain, show the real destination where practical, and keep the number of links small. Custom tracking domains for cold email shows how to set one up.

Cause 3: Attachments

Gmail blocks some file types outright and warns on others. Archives, macro-enabled Office files and unusual formats from senders a recipient has not corresponded with are especially likely to trigger warnings. Send links to files hosted on a reputable service instead, or attach only common formats such as PDF after the recipient knows you.

Cause 4: Lookalike or brand-like domains

If your domain looks like a well-known brand, or like the recipient's own company domain, Gmail may suspect impersonation. Cold email domains that are close variants of a big company's name are particularly risky. The lookalike domain checker shows how close your domain is to others.

Display names matter too. A display name that is a famous brand or a person at the recipient's company, sent from an unrelated domain, looks like spoofing.

Cause 5: Content that resembles phishing

Messages that ask readers to verify an account, reset a password, confirm payment details or act urgently look like phishing templates. If you legitimately send these, for example as a SaaS company, make sure authentication is perfect and the message comes from the same domain as your website.

Cause 6: New or low-reputation sender

A domain with no sending history, or one that has recently produced bounces and complaints, gets less benefit of the doubt. Warnings are more likely on borderline content. Warm up new domains gradually and keep bounces low. Improve sender reputation covers the longer-term work.

How to test whether you fixed it

1. Fix authentication and check DNS has propagated.
2. Send the exact message to a personal Gmail account you have never emailed from that sender.
3. Check for a banner, and use "Show original" to confirm SPF, DKIM and DMARC pass.
4. If the banner remains, remove links and attachments and test again to isolate the cause.

When someone else is spoofing you

Sometimes the warning appears on messages you did not send: someone is spoofing your domain. A DMARC policy of p=quarantine or p=reject, once all your legitimate senders align, tells Gmail to treat those fakes harshly. The email spoofing test shows how exposed your domain is.

Worked example (illustrative)

A small SaaS company notices customers asking whether its password reset emails are real. Gmail shows a yellow "Be careful with this message" banner on them.

1. "Show original" shows DKIM passing for the company's email service, not for the company's own domain, and DMARC failing.
2. The reset link points to a shared click-tracking domain rather than the app's own domain.
3. The company authenticates its domain in the email service, adds a custom return-path, and turns off click tracking on transactional emails.
4. A fresh test to a new Gmail account shows DMARC passing and no banner.

Support tickets about suspicious emails stop within a week.

Quick checklist

• SPF, DKIM and DMARC pass and align for the From domain
• No URL shorteners; tracking links on your own domain
• No risky attachments on first contact
• Display name and domain match your real brand
• Tested on a fresh Gmail account

Build trust from the list up

Banners are about whether Gmail trusts a message. Sender reputation is part of that trust, and bounces from unverified lists are one of the fastest ways to lose it. Verify before you send: upload a list on the verify page and you get 100 free email checks when you sign in with Google, no card.