Why Your Cold Email Shows a Warning Banner and What to Fix

"You don't often get email from [sender address]" is Outlook's first contact safety tip. Microsoft 365 adds it, at companies where the policy is switched on, when the person reading your email rarely or never gets mail from your address. That describes every cold email anyone sends. It does not mean your message was flagged as spam, and no change to your copy or subject line will remove it.

Gmail uses its own set of signals. Your email address printed next to your name is Gmail's normal note about someone the reader has never emailed. A question mark, a "via" label or a warning banner above the message is a different matter. Those point at authentication and domain alignment, and most of that is yours to fix.

So the rule fits in two lines. If the label is about the relationship, meaning new, rare or external, leave it alone. If it is about identity, meaning unauthenticated, sent via another domain or suspicious, fix the sender before you change a word of the email.

Why care about a label on an email that arrived? Because prospects do not decide from the message. As I see it, nobody buys because of an email; people buy once they have audited you. The banner is the first line of that audit, and the prospect's inbox writes it before they read anything of yours.

If you want the wider sending rules rather than the labels, I cover what Google, Yahoo and Microsoft require from senders in a separate post.

What does the warning banner actually mean?

This article covers only email that arrived. A message that bounced or went to spam has a different problem, and the prospect never sees these labels on it in the inbox.

Delivered cold email can carry three kinds of signal. A banner is a line of text above the message body. A label is a mark beside the sender's name, such as a question mark. Sender details are extra text next to your name, like your full address or "via" and a domain.

They come from different products and are controlled by different people. Outlook's first contact tip belongs to Microsoft's anti-phishing policies, which the admin at the prospect's company manages. Gmail's question mark and warning banners come from Gmail's phishing and authentication protection, which a Google Workspace admin can tune.

Google Workspace adds a third, separate switch: external recipient warnings, which remind staff to be careful with people outside the company.

A banner also tells you the email got through. When Gmail refuses a message outright, the sending server gets an error code back. Google's list of those errors includes a poorly rated sending IP and missing SPF or DKIM.

The warning sits between delivery and refusal. Google says that when an email looks like phishing, it might show a warning or move it to spam.

Which warning does Outlook show first?

This is the one most people search for. Microsoft's documentation, at the time of writing, gives the exact text for a single recipient: "You don't often get email from [email address]." When several people at the company got the same message, it reads "Some people who received this message don't often get email from [email address]."

The trigger is one question: does this recipient often get messages from you? On a cold email the answer is no.

Two other details on the same Microsoft page matter more to a sender than the wording.

First, Microsoft says the tip works independently of its spoofing and impersonation checks. In practice, passing authentication does not switch it off. A sender with perfect SPF, DKIM and DMARC gets the same line as a careless one.

Second, Microsoft recommends keeping the tip on. It names only three cases where Outlook skips it: S/MIME signed messages, messages that an admin rule lets bypass spam filtering, and messages sent to a mailbox under a week old. None of those is a realistic lever for cold outreach. The bypass rule and the mailbox age both sit on the recipient's side.

So who can turn it off? Only the recipient's company. The tip is a setting in its anti-phishing policy, so the change has to come from its admin.

Expect the tip on first emails into Microsoft 365 companies that keep it on, so put who you are and why you wrote to this person in the first two lines, right under it.

What Gmail banners and sender labels are you seeing?

Gmail's marks work differently from Outlook's tip, because the identity marks among them are in your hands. Four things are worth telling apart.

Your email address next to your name. Google says Gmail shows the sender's address beside the name when it is someone the reader has not emailed in the past. For cold email, that is expected. It is Gmail's way of saying "this person is new to you."

"via" and a domain. Gmail adds this when the sending domain differs from the one in your From line. The prospect sees your name, then a domain that is not yours. On the same page, Google's fix is to publish an SPF record, sign messages with DKIM and make the From domain match the authenticated domain.

A question mark next to your name. Google's Workspace documentation says Gmail marks unauthenticated mail with a question mark beside the sender. Gmail is telling the reader it could not confirm the email came from who it claims to be.

A warning banner above the message. Workspace admins choose what happens to mail Gmail considers suspicious, and one option is to leave it in the inbox with a warning. By default, Gmail shows warnings and moves untrustworthy email to spam. A banner on a delivered message means Gmail had doubts about it and still let the prospect see it.

Look at what Google tells users to do when they see one: stay away from links and attachments, and never type in personal details. That instruction sits directly above every link in your email.

Which banner can you remove and which is normal?

Here is the full map, with Outlook and both Gmail setups in one place.

The last row confuses people most, because it is mainly about the prospect's own reply, not your email. Google says the external recipient warning can show as a banner, plus a colored border or icon beside outside addresses. It appears when a thread includes external recipients, when someone replies to an external sender, and when they compose a new message to one.

It does not show for addresses in the organization's directory or the user's contacts. So the prospect mostly meets it while writing back to you. It exists to stop staff replying to outsiders by accident, and it says nothing about the quality of your email.

The decision rule for founders and SDRs:

1. Read the actual words in the banner before you do anything.
2. "Don't often", "haven't emailed" or "external" means relationship. It is expected on a cold email. Do not rewrite the copy because of it.
3. "via", a question mark, or a banner calling the message suspicious means identity. Check authentication and domain alignment first, and leave the copy alone until both pass.

If your emails are not arriving at all, the problem is inbox placement, a separate subject. Start with the inbox checks in this 30-point cold email audit.

What setup fixes the problem before volume?

Identity labels usually come from a sender that was set up in a hurry. The repair happens in DNS and in the sending schedule, and none of it touches the email text.

1. Separate sending domains. My team never sends cold campaigns from the domain a company uses for invoices, support and contracts.
2. Authentication on every domain before the first send. SPF, DKIM and DMARC always come first when I build a sender, and volume waits. Gmail's sender guidelines ask every sender for SPF or DKIM. Senders of more than 5,000 messages a day to Gmail accounts need all three, and the From domain has to align with the SPF or DKIM domain for DMARC to pass.
3. Alignment inside your sending tool. If the tool signs mail with its own domain, the "via" label comes back even with good DNS records. Set up DKIM for your own domain inside the tool, then send yourself a test.
4. Warm-up. No new mailbox my team runs writes to a real prospect until it has warmed up for at least 10 to 14 days.
5. Volume last. Raise sending volume only after warm-up. New mailboxes pushed hard straight away are a classic way to earn the reputation problems Gmail lists in its error codes.

Before a client's first prospect sees a message, my team has handled the domains, published SPF, DKIM and DMARC, warmed the mailboxes and started monitoring. The sending IPs are dedicated, and we split them by domain as well as by client, so one client may send from 10 to 20 of them.

The full build, including how much each mailbox should send per day, is in my guide to cold email domains and inboxes.

How should you read a banner before blaming the copy?

When one prospect mentions a banner, write it down. When the same label shows up across several clean sends, work through this list in order and stop at the first failure.

1. Name the mail app and the exact label. Outlook tip, Gmail address, "via", question mark, warning banner or external border. Use the table above to sort it into relationship or identity.
2. Send a test to yourself. Use a personal Gmail address and, if you can, a colleague's Microsoft 365 business mailbox. Look at it the way a prospect would, in Gmail web as well as on a phone.
3. Open the message headers. Confirm SPF, DKIM and DMARC all pass for the domain in your From address, not for your sending tool's domain.
4. Check the sending domain's age and warm-up. A domain bought last week and mailed from on day two is still a stranger to every inbox.
5. Check the list. Addresses you never validated bounce, and bounces damage the same sender reputation you just built. My rule is that bounces stay below 0.5%.
6. Only now open the copy. Length, tone and the ask come last.

I run it in this order because no rewrite saves a poor list, and no rewrite saves a sender the inbox does not trust. I still push for short, human emails over templates that read like a machine wrote them. But a well-written email under a question mark is still an email from someone Gmail could not identify.

Prospects look a sender up before they answer, and an identity label means that check starts from suspicion.

What should you do if prospects reply with caution?

Some prospects answer the banner directly. "Is this real?" "How did you get my email?" "Our IT flagged this." Treat those as replies, because they are. The person took the time to answer someone their inbox warned them about.

The rule is more context and less pressure. Your answer needs four short lines:

1. Who you are, with the company name and your role.
2. Why you wrote to them in particular, meaning their company, their role, their market.
3. One proof point, with a number and the time it took.
4. A next step that needs no click, such as "Reply with a day that suits you and I will send a plain invite."

That fourth line matters because of the banner. Gmail has just told this person to avoid links in your email, so do not make a link the only way forward. Leave the calendar link out of the reply.

Do not promise that the warning will go away, and never tell a prospect to whitelist you or to ignore their IT team's settings. That reads exactly like the phishing the banner was built to catch.

If cautious replies keep arriving and the labels behind them are about identity, go back to the setup checklist. If they are about relationship, keep sending to the next person on the list.

Prospects mentioning a banner and you cannot tell if it is the sender setup or the copy? Tell me what you are seeing on a quick call and I will look at it with you.