What do Gmail's warning banners mean, and how do you stop them on your mail?

Gmail puts a colored warning above messages it doesn't trust. For recipients, that's a useful prompt to slow down. For a business whose own invoices or newsletters carry the warning, it's a problem that costs replies and payments.

Google doesn't publish a complete list of banner wording, and the text varies between Gmail on the web and the mobile apps. What it does document is the checks behind them. This guide maps the three warnings people ask about most to those checks, and shows what you can fix as a sender.

What are Gmail's warning banners?

Gmail warns in a few different ways:

The exact sentence under each banner is the best clue to the cause. Read it before you change anything.

What does "Be careful with this message" mean?

It's Gmail's general caution heading. The line beneath it says why, and Google lists the common reasons for warnings on messages it files as spam (Gmail Help):

• Spoofed email addresses: "The email address looks very similar to the email address of a known sender."
• Phishing scams: "The email may be a trick to get you to share personal information, like passwords or credit card numbers."
• Messages from an unconfirmed sender: "Gmail can't confirm who sent you the email."
• Policies set by administrators: your organization's admin "might set controls to mark certain emails as spam."
• Spam from one of your contacts: a contact's account may have been taken over.

In Google Workspace, admins can produce this kind of banner on purpose. The Safety settings for attachments and spoofing default to Keep email in inbox and show warning, and they cover lookalike domains, employee name spoofing, mail spoofing your own domain and "any unauthenticated emails" (Google Workspace Admin Help). Our guide to Gmail spam settings in Google Workspace walks through them.

What triggers it for a legitimate sender?

When it's your own mail getting the banner, the usual causes are:

1. No authentication. Neither SPF nor DKIM passed. Google's "Protect against any unauthenticated emails" setting checks for authentication "(by any domain) with either SPF or DKIM (or both)."
2. Your From address looks like a spoof. Mail claiming to be from your domain arrives from a server your SPF doesn't list, and isn't DKIM-signed for your domain. Website forms and scanners are frequent culprits; see website form emails going to spam.
3. A display name that matches an employee on mail from an outside address, which can trip the employee name spoofing check at the recipient's organization.
4. Content that looks like phishing, such as a login link to a different domain from the one in your From address.

What does "This message seems dangerous" mean?

This is the stronger warning. Google's phishing guidance says it warns "about dangerous messages, unsafe content, or deceptive websites," and that if you receive a warning you should "avoid clicking links, downloading attachments, or entering personal information" (Gmail Help). Google doesn't publish the detection rules behind it.

As a recipient, treat it as a stop sign. Don't click, verify by another channel, and use Report phishing from the More menu next to Reply. Our guide on what to do after clicking a phishing link helps if someone already clicked.

As a sender, a dangerous warning on genuine mail usually points to something in the message, not just DNS:

• Links through a URL shortener or tracking domain that has a poor reputation.
• A link whose visible text shows one address while the link goes elsewhere. Google tells users to hover over links because "If the URL of the link doesn't match the description of the link, it might be leading you to a phishing site."
• Attachment types attackers favor; see dangerous email attachment types.
• A compromised account or website sending on your behalf. If you didn't send the message, start with signs an email account is compromised.

What does "Gmail couldn't verify that <domain> sent this message" mean?

Gmail users commonly report this text alongside the question mark Gmail shows next to the sender's name; Google's help pages document the question mark rather than the exact wording. Google's explanation is precise: "When an email isn't authenticated, that means Gmail doesn't know if the message is coming from the person who appears to be sending it" (Gmail Help).

Google also says "Messages that aren't authenticated aren't necessarily spam. Sometimes authentication doesn't work for real organizations who send mail to big groups, like messages sent to mailing lists."

How do you check a message's authentication?

In Gmail on a computer, open the message and select the Down arrow below the sender's name. Google says the message is authenticated if you see a Mailed by line with a domain and a Signed by line with the sending domain. For the full picture, select More > Show original and paste the headers into our Email Header Analyzer. In other mail apps, Google says to find the Authentication-Results header and look for spf=pass or dkim=pass.

What fixes the question mark?

Google's instructions for senders whose own mail shows the question mark (Gmail Help):

1. "Make sure messages you sent are authenticated using DKIM (preferred) or SPF."
2. "Use RSA keys that are at least 1024-bits long. Emails signed with less than 1024-bit keys are considered unsigned."
3. "Do not use the DKIM length tag (l=) in message headers."

And a warning about forwarding: if a forwarded message passes SPF or DKIM "but ARC shows it previously failed authentication, Gmail treats the message as unauthenticated." Our guide on how forwarding breaks SPF and DMARC explains why.

How do you stop Gmail warnings on your own mail?

Work through this list in order. Each step removes a common cause.

1. List every service that sends as your domain: your mailbox provider, website, CRM, invoicing, newsletter and help desk tools.
2. Turn on DKIM for each one with your own domain, not the provider's default. Our DKIM records by provider pages list where each service publishes its key. Check the result with the DKIM Checker.
3. Publish one SPF record that includes the services that send from your domain. The SPF Record Generator builds one and counts lookups.
4. Publish DMARC, starting at p=none with reports, so you can see which messages fail. Google requires DMARC for senders of 5,000 or more messages a day to Gmail and says the policy can be none (Gmail Help).
5. Make sure the domain in your From address aligns with your DKIM or SPF domain. Google requires this alignment for bulk senders.
6. Meet Google's other sender requirements: valid forward and reverse DNS for sending IPs, TLS, RFC 5322 formatting, and user-reported spam below 0.3% in Postmaster Tools.
7. Test. Our Email Deliverability Test shows the SPF, DKIM and DMARC results for one message. Then send a copy to a personal Gmail account and check Show original.

Our Google Postmaster Tools guide shows how to watch authentication and spam rates from Gmail's side after you fix things. For the full rule set, read Gmail, Yahoo and Microsoft bulk sender requirements.

Should recipients or admins ever hide the banners?

Recipients can mark a message as safe. On the "This message could be a scam" banner, Google offers Looks safe or Ignore, I trust this message when you're sure. On mail in Spam from an unconfirmed sender, Google suggests Report not spam if you're sure the sender is trustworthy (Gmail Help).

Workspace admins have a bigger switch. Google says Gmail "never displays warning banners" when you choose Bypass spam filters and hide warnings for messages from senders or domains in selected lists or the all-senders version (Google Workspace Admin Help). That hides warnings on attacks as well. If one partner's mail keeps getting warnings, ask them to fix authentication first. If you must allow them, use an approved senders list with sender authentication required; see how to whitelist a sender safely.

Note the limit Google states: warning banners "appear only in Gmail web," and "Third-party apps do not display a warning banner." Staff reading Gmail in Outlook or Apple Mail won't see them.

Next steps

1. Send a message from each of your systems to a Gmail account and check Show original for SPF, DKIM and DMARC.
2. Check your records with the SPF Checker, DKIM Checker and DMARC Checker.
3. Fix one sender at a time, then run the Email Deliverability Test again.
4. Set up Google Postmaster Tools to track the results.

For inbound protection on your side, a filtering service such as iBlockSpam can quarantine suspicious mail before it reaches users. More guides are under SPF, DKIM and DMARC.