When you use the SMTP relay service to send Gmail through Google servers, Google monitors outgoing messages. If Google detects large amounts of spam being sent from your registered or non-registered user accounts, you might get an email alert about the issue.
Non-registered user accounts are accounts that:
- Belong to your domain, or
- Present your domain name in the HELO argument during SMTP relay.
After 24 hours, if a Gmail account is still sending spam, the account is suspended. You'll get an email alert letting you know about the suspension. Restore suspended accounts when the issue is resolved. We recommend you keep non-registered accounts suspended until you identify the source of the spam.
Why are my accounts sending relay spam?
If user devices are infected with harmful software, they can start sending large amounts of spam. Devices that are set up as open relays might also cause high spam volume. Find out more by investigating the source of the spam.
Sending spam harms your legitimate email
Sending large amounts of spam can damage your domain's reputation. Legitimate emails from your domain might be rejected, or sent to spam. A high volume of outgoing spam can cause you to reach your relay rate limits, resulting in slow or unsuccessful message delivery.
Why does Google suspend user accounts?
To help protect your domain reputation and maintain Gmail delivery, Google suspends accounts that send large volumes of relay spam. Messages are still delivered to suspended accounts, but the account owner can’t sign in or send messages.
How do I identify and fix spam problems?
Review the sending patterns of the accounts listed in the Admin email alert.
Understand user sending patterns
Use Email Log Search to identify the quantity and types of messages relayed by the account. To search by the combination of sender and relay IP address, enter the relay IP address in the Sender IP field
If you use Gmail for bulk sending, review sending best practices in Prevent mail to Gmail users from being blocked or sent to spam.
Investigate user devices
Investigate user devices using the IP addresses listed as Originating Device IP in the Admin email alert.
The email alert lists up to 10 of the sender's most recently used IP addresses. If multiple IP addresses are listed, check device logs to determine which IP address and device is responsible for the spam. Scan the device for potential viruses or malicious software.
If the sending IP address is a private IP address, it might be the internal IP address for a device on your network.
