When Gmail says your emails have suspicious links
Gmail is careful to protect its users from phishing activities, so it classifies suspicious emails as spam and shows a red warning on the message. In short, this warning means Gmail distrusts a link (or the sending setup) in your email — usually because a linked, redirect, tracking, or shortener domain has a poor reputation, or because your domain isn’t authenticated. To help senders identify and fix these mistakes, Gmail notifies recipients of the reason the mail is flagged. If your URLs are improper, Gmail classifies the email as spam with a warning like the following:
“Be careful with this message. It contains a suspicious link that was used to steal people’s personal information. Unless you trust the sender, don’t click links or reply with personal information.”
“Be careful with this message. Similar messages were used to steal people’s personal information. Unless you trust the sender, don’t click links or reply with personal information.”
These warnings make your contacts lose trust in your future emails; they may stop opening them and even mark them as spam. Because this badly affects your email deliverability, we request you to take immediate action.
How to avoid Gmail marking your emails as spam due to suspicious URLs
The warning shows that there’s something suspicious in the URLs you used (or in how your mail is authenticated). So, focus on your links and check that your sending practices follow the suggestions below:
Authenticate your sending domain
Many “suspicious” warnings are really identity warnings. If your mail isn’t authenticated, Gmail can’t confirm you’re the real sender and treats links in the message as risky. Set up SPF, DKIM, and DMARC, and make sure the domain in your From address aligns with the authenticated domain. Google has required this for bulk senders since February 2024.
Check for broken URLs
Always ensure your URLs work properly before including them in an email. Redirection to a non-existent page leads to abuse complaints from contacts.
Check for blacklisted link and sender domains
URLs with blacklisted domains are a common reason for the warning — and it’s not only your sending domain that matters. Gmail weighs the reputation of every domain in the message: the link domain, any redirect or click-tracking domain, the image host, and the URL shortener. Check both your sending domain and your link domains against anti-spam services such as Spamhaus, Spamcop, and Barracuda. If any are listed, raise a de-list request with that service.
Don’t include URLs with multiple redirections
Multiple redirections are a common trick used by spammers. When contacts encounter multiple redirections, they feel insecure and mark the email as spam. So, ensure that your URLs redirect straight to the desired page.
Don’t include shortened URLs from public services
If the domain of a shortened URL is blacklisted, the URLs are considered suspicious. Avoid publicly available URL shorteners, whose shared domains are frequently abused; use a branded, custom tracking domain instead so the link reputation is your own.
Don’t seek contacts’ personal information
URLs should not be used to seek personal information such as email address, passwords, residential address, phone number, or credit card information.
Avoid suspicious or spammy phrases in URLs and landing pages
Phrases such as “online dating”, “lose weight”, “please help”, “extra income”, and “donate” — in the URL or on the page it redirects to — make your contacts doubt the legitimacy of your emails and mark them as spam. Send test emails to your own Gmail account to identify anything wrong before sending the actual campaign.
Keep your domain registration accurate and use an established domain
Historically this advice was “maintain a proper WHOIS registry.” That has changed: since GDPR (2018), registrars redact registrant contact details by default, and ICANN retired public WHOIS for generic domains in January 2025 in favor of RDAP — so filters no longer read your public contact fields. What still matters is that your registration is genuine and current with your registrar, and that you send and link from an established domain with a track record. Brand-new, throwaway link or shortener domains have no reputation and are far more likely to trigger the suspicious-link warning.
Since URLs are the gateway to your click rate, it makes sense to optimize them. If your URLs (and your authentication) appear safe in your future emails, Gmail eventually makes your emails land in the inbox as expected.