Gmail spam filter 2026: how it works and how to stay in inbox

Gmail handles roughly 1.8 billion accounts. It filters more mail per second than any other provider on earth, and it is opinionated, personalised, and mostly consistent once you understand the architecture. This is not a guessing game. The filter has public documentation, a Postmaster Tools dashboard, and a decade of patterns confirmed by both Google engineers and independent researchers.

The stack: four systems, not one

When people talk about "the Gmail filter" they usually mean the spam filter. In reality Gmail runs at least four decision layers on every inbound message:

• Spam filter \u2014 binary verdict: Inbox-eligible or Spam folder. The only layer that can hide your mail.
• Tab classifier \u2014 for Inbox-eligible mail, decides Primary vs Promotions vs Updates vs Social vs Forums.
• Priority Inbox / Important markers \u2014 decides which Primary messages get the yellow Important tag and appear higher.
• Per-user model \u2014 adjusts all three layers above based on how this specific recipient has handled your mail in the past.

Understanding which layer you are fighting changes the fix. A message in Spam needs a reputation or authentication fix. A message in Promotions is a content and format problem. A message that is Primary but low is a relationship problem.

Authentication signals

Since February 2024 Gmail requires SPF or DKIM, a published DMARC record, and one-click unsubscribe headers for bulk senders (5,000+ per day to Gmail addresses). The bar has now effectively extended to anyone sending to Gmail in volume: a passing authentication stack is table stakes.

Alignment matters as much as a pass. dmarc=pass with SPF-alignment or DKIM-alignment against your From domain is the signal Gmail actually weighs. A raw spf=pass on a return-path subdomain that doesn't match your From buys you very little.

Domain reputation signals

Gmail maintains a running reputation score per domain, not per IP. You can see an approximation of it in Postmaster Tools under the Domain Reputation chart. The buckets are Bad / Low / Medium / High, and the signals feeding the score are:

• Spam complaint rate \u2014 must stay under 0.3% averaged, with no single day above 0.3%. Above that and the reputation slides within days.
• Volume consistency \u2014 a stable Monday-to-Friday curve beats big Tuesday spikes. Gmail treats burst patterns as a compromised account signal.
• Engagement quality \u2014 replies, stars, labels, forwards count more than opens. Opens are heavily diluted since Apple MPP.
• Authentication pass rate \u2014 any dip below ~99% on SPF/DKIM is noticed.

Engagement signals per recipient

Gmail weighs engagement signals at two scales: aggregated across millions of Gmail users (domain reputation) and for each individual Gmail user (per-user model). The second is where most of the post-delivery routing happens.

Per-recipient signals Gmail tracks:

• Opens weighted by reading time (fast close = low signal).
• Replies \u2014 the strongest positive signal on the platform.
• Star, label, move-to-folder actions.
• "Not Spam" clicks from the Spam folder.
• Delete-without-read \u2014 mildly negative.
• Mark as spam \u2014 strongly negative, fed back to domain reputation.

Content signals

Gmail runs its own content model, separate from SpamAssassin or Rspamd. It looks at HTML-to-text ratio, link reputation (cross-checked against Spamhaus DBL and Google Safe Browsing), subject line patterns, and the structural features of the message \u2014 things like missing plain-text parts, broken MIME structure, and suspicious header orders.

A few content patterns still reliably hurt in 2026: subject lines with three or more exclamation marks, all-caps words in the From display name, link text that doesn't match the link destination, and a single image body larger than ~400KB with no plain-text fallback.

Behaviour and transport signals

Below the content layer, Gmail watches transport patterns: TLS use on connection (now effectively required), PTR / reverse-DNS alignment, HELO hostname sanity, and volume pacing. New sending IPs that open with a 10,000-message hour are throttled or blackholed before any content even gets scored.

The personalised layer

Your friend\u2019s Gmail may inbox you while a stranger\u2019s sends you to Spam \u2014 with the same message and same sending domain. The per-user model weighs whether that recipient has ever replied to you, added you to contacts, opened your previous mail, or marked earlier messages as spam. This is why even a perfectly-authenticated sender will see variable inbox rates across different seed accounts.

How to stay in inbox, in priority order

1. Authentication first. SPF, DKIM with 2048-bit keys, DMARC at p=quarantine or stronger, all passing with alignment.
2. Warm-up consistently. New domains need 3\u20134 weeks ramping from 10\u201320/day to production volume with engaged recipients.
3. List hygiene. Remove anyone who hasn\u2019t engaged in 90 days from high-frequency streams. Suppress bounces within 24 hours.
4. Engagement-first content. Write the opening sentence like a human replying to a human. The reply rate moves more than every subject-line trick combined.
5. One-click unsubscribe. Both List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click, and honour it within 48 hours.

Postmaster Tools: the only direct window

Google Postmaster Tools (postmaster.google.com) is the only first-party window into how Gmail sees your domain. It shows:

• Domain and IP reputation (Bad/Low/Medium/High).
• Spam rate (user-marked).
• Authenticated traffic percentages for SPF/DKIM/DMARC.
• Encryption (TLS) rates.
• Feedback loop reports for very large senders.

What it hides: per-message placement, the tab classifier verdict, Promotions vs Primary, and the per-user model contribution. For those signals you need a placement test across real seed accounts.

Frequently asked questions