How the Gmail Spam Filter Works in 2026: Four Layers, One Blind Spot

The four layers, in the order a message meets them

Google doesn’t publish a flowchart of its filter: a public blueprint would just be a study guide for spammers. But its engineering blogs, sender guidelines, and security announcements describe the system in enough detail to map the layers and what each one is looking for.

The right-hand column, top to bottom, describes the same sender: truthful, low-volume, well-written, targeted. That sender passes everything.

Layer 1: Sender reputation

Before Gmail reads a word of your message, it knows who you are. Every sending domain and IP address carries a history: how much mail it sends, how much of that mail users report as spam, how long the domain has existed, whether its volume spikes in suspicious bursts. A domain registered on Tuesday that starts blasting on Wednesday gets treated very differently from one that has sent clean mail for a decade.

Since February 2024, Google has enforced this layer with explicit rules. Anyone sending more than 5,000 messages a day to Gmail accounts must authenticate their mail, support one-click unsubscribe on marketing and subscribed mail, and keep their user-reported spam rate below 0.3%, or watch their delivery get throttled and then refused. The results were large enough that Google published them: Gmail users received 265 billion fewer unauthenticated messages in 2024 than the year before, a 65% drop.

Reputation is also why blocking one address does so little against a determined sender, a limit we cover in our guide to blocking emails in Gmail: reputation attaches to domains and infrastructure, and a sender willing to burn a domain and register a new one arrives with a blank slate.

Layer 2: Authentication, or proving you are who you claim

Email’s original protocol lets anyone put anything in the From line, which is why three separate standards exist to patch the hole. Gmail checks all three on every message.

SPF (Sender Policy Framework, RFC 7208, standardized in 2014) is a public list a domain owner writes: these servers, and only these, may send mail for my domain. A message arriving from anywhere else fails the check.

DKIM(DomainKeys Identified Mail, RFC 6376, 2011) is a cryptographic signature attached to each message. If the signature verifies against the sender’s published key, the message really came from that domain and wasn’t altered in transit.

DMARC(RFC 7489, 2015) ties the two together and adds a policy: the domain owner declares what receivers should do with mail that fails SPF and DKIM alignment (deliver anyway, quarantine, or reject), and gets reports on who is sending in their name. Google’s bulk-sender rules made DMARC mandatory for large senders, which is what drove that 65% collapse in unauthenticated mail.

Notice what authentication does and doesn’t prove. A passing DMARC check means the sender is genuinely salesguy@realcompany.com. It says nothing about whether you want salesguy’s email. Authentication verifies identity, not intent, and every legitimate cold-outreach tool on the market configures SPF, DKIM, and DMARC correctly, because delivery depends on it.

Layer 3: Content models that read the message

The layer most people picture when they hear “spam filter” is the one that reads the mail, and it’s where Google’s machine-learning investment is heaviest.

In 2019, Google added TensorFlow-based models specifically to chase the fraction its rule-based systems missed: image-based spam, messages with hidden embedded content, and low-volume spam hiding inside legitimate traffic from new domains. Those models alone blocked around 100 million additional spam messages a day.

In late 2023 came RETVec, a new text vectorizer trained to see text the way a human does. Spammers evade word-matching with homoglyphs (a Cyrillic “а” standing in for a Latin “a”), invisible characters, and deliberate typos; RETVec maps visually similar characters together, so “fr𝗲𝗲 m𝗼ney” reads as exactly what it is. Swapping it into the spam classifier improved the detection rate by 38% and cut false positives by 19.4%, which Google called one of its largest defense upgrades in recent years.

Attachments get their own pipeline: deep-learning document scanners process more than 300 billion attachments a week, a volume that matters because malicious documents mutate constantly. By Google’s count, 63% of the malicious documents it blocks differ from one day to the next.

Layer 4: Your reports, everyone’s filter

The fourth layer runs on user reports. Every time someone clicks Report spam, two things happen: Gmail adjusts what it believes about that account’s preferences, and the report feeds the global models as a labeled training example. Google’s help pages are direct about the first part: the more spam you report, the better Gmail gets at catching similar mail for you. The second part scales globally: multiply one click by billions of accounts and you get a continuously refreshed map of what spam looks like this week, which is how the filter tracks adversaries that change tactics daily.

The same mechanism runs in reverse: dragging a message out of Spam, or clicking Report not spam, is a labeled example in the other direction. Everything left in the Spam folder is deleted automatically after 30 days.

What you can actually adjust

Almost nothing, directly. Personal Gmail exposes no strictness slider and no way to see a message’s spam score. What you control is the input: report what slips through instead of deleting it, block the persistent individuals, write filters for patterns you can describe, and unsubscribe from lists you recognize. One-click unsubscribe (RFC 8058, the standard behind the button next to a sender’s name) obliges compliant bulk senders to process the request within two days; our guide to unsubscribing safely covers when that button is your friend and when it’s a trap. Each of these nudges the filter’s model of your account. None of them changes what the filter is fundamentally looking for.

The mail the filter cannot see

Every layer of the Gmail spam filter is tuned to one underlying question: is this sender lying about who they are, or mailing at abusive scale? A sender who is neither passes untouched.

Cold outreach makes the clearest case. A sales development rep at a real company, sending 40 personalized emails a day from an authenticated domain with a groomed reputation, trips no layer. Reputation: clean. SPF, DKIM, DMARC: all passing, because the outreach platform set them up. Content: a short, personally addressed note that reads like mail from a colleague. User reports: too few recipients, and too few of them angry enough to click the button. To the filter, this message is indistinguishable from your dentist confirming an appointment, and treating it as spam would mean treating your dentist as spam too.

Phishing works by the same logic. Kits are tested against the very filters they need to beat, and the volume behind them is industrial: Kaspersky alone blocked over 554 million attempts to follow fraudulent email links in 2025. The FTC logged $12.5 billion in reported US fraud losses in 2024, a 25% jump over the prior year, with email the most common first contact. Gmail stops the overwhelming bulk of it; what’s left is mail built well enough to clear every layer above.

The economics forbid closing the gap, too. For a system serving billions of people, a false positive (your job offer in Spam) costs far more trust than a false negative (one more pitch in your inbox), so the dial has to sit conservative. You can read the priority in Google’s own announcements: when RETVec shipped, the 19.4% cut in false positives got equal billing with the detection gain. Kaspersky measured spam at 44.99% of all email traffic in 2025. A filter blocking 99.9% of that firehose still passes a steady trickle, and the trickle is disproportionately the hardest, most legitimate-looking mail.

A second filter, aimed at the gap

Sieve runs behind Gmail’s filter and judges only the mail Gmail admits, against the question Gmail’s filter can’t ask: not “is this sender abusive?” but “did you ask for this?” Cold outreach gets labeled Solicitor and archived out of your inbox; phishing gets labeled Malicious, with links screened through Google Web Risk. Archived, never deleted: everything stays under its label in Gmail, and dragging a message back to the inbox records a correction the classifier learns from. Reply to a sender and they’re permanently trusted. You can steer it in plain English, “never touch anything from my kid’s school” being a real instruction it accepts.

Because a tool in this position touches your mail, the data handling is strict: messages from people you know are never read by the AI at all, Sieve stores metadata only (plus the encrypted subject line of flagged mail, kept 30 days), and nothing is ever used to train models. The full accounting is in our Privacy Policy. It’s Gmail-only, from $10 a month (the $20 Pro plan adds a second inbox), 15% off yearly, with a 7-day free trial.

Where this leaves you

If your inbox is mostly clean, keep doing what’s already working: report instead of deleting, and the filter keeps getting better for you specifically.

If the leftover mail is subscriptions and list noise rather than strangers, the fix is unsubscribing and cleanup. The tools built for that job aren’t spam filters: we compared SaneBox, Clean Email, and Mailstrom head to head and wrote a standalone look at SaneBox, whose own positioning is triage of everything rather than filtering of junk.

If what’s left is the mail this article ended on, authenticated strangers and engineered phishing, that’s the gap Sieve and its neighbors compete over. Our spam filter roundup maps the field, and the rest of our guides take the free tactics one at a time.