Does Gmail Actually Detect AI-Written Cold Email?

You pasted your cold email into ChatGPT to tighten the second paragraph, sent eleven messages before lunch, and three of them landed in spam. A post going around outbound circles that same morning had an explanation ready: Gmail and Outlook

You pasted your cold email into ChatGPT to tighten the second paragraph, sent eleven messages before lunch, and three of them landed in spam. A post going around outbound circles that same morning had an explanation ready: Gmail and Outlook now run AI detectors that flag anything a model touched. You didn't write anything spammy. You wrote a normal email and asked a model to help you cut it down. So now you're wondering whether Gmail actually detects AI-written cold email, or whether outbound Twitter just found a more satisfying villain than your own DNS records.

Google's own explanation of spam filtering never names who wrote the email

Google publishes its own account of how Gmail decides what's spam, and it's worth reading before you trust a screenshot from someone selling a "beat the AI filter" course. The signals it names are IP address and domain reputation, whether bulk senders are authenticated, and user feedback, meaning what people do when your email lands: mark it spam, reply, or ask for more. Content-generation method doesn't appear on that list. Not as a primary signal, not as a footnote. Gmail's filter, by its own maker's description, has no opinion about whether a human or a model typed the words in front of it.

RETVec was built to catch disguised text, not machine-written text

The tool people usually point to when they claim "Gmail has an AI detector" is RETVec, Google's text classifier that shipped in late 2023 and still underpins Gmail's spam model. What Google's security blog actually says RETVec does is catch homoglyphs, invisible characters, and keyword stuffing, the tricks spammers use to slip a message past a classifier by making it visually readable to a human but structurally different to a machine. That's an evasion problem, not an authorship problem. RETVec doesn't ask "did a model write this." It asks "is this text trying to hide what it says."

Microsoft's AI detection signals are aimed at attackers, not your outbound

Microsoft gets cited even more often, because its security blog does use the phrase "AI detection signals." Read the post it comes from and the target is campaigns that impersonate AI brands and tools themselves: phishing kits pretending to be ChatGPT billing pages, fake Copilot plugins, fraudulent DeepSeek installers. One ChatGPT-themed credential-harvesting run named in that post sent up to 100,000 emails in a single day. That is the AI-themed attack Defender is built to catch: mass impersonation of an AI product, at industrial volume. It is not a system for deciding whether the sales email you sent to a prospect this morning had a model's fingerprints on it.

Telling human text from AI text apart is still an unsolved problem

There's a reason neither company built the detector outbound-Twitter thinks exists: nobody has built one that works reliably enough to trust on live traffic. A Stanford study on GPT detectors found they consistently misclassify essays from non-native English writers as AI-generated, while accurately clearing writing from native English speakers, the exact opposite of a signal you'd want to base a delivery decision on.

If academic detectors purpose-built for this one task still can't reliably separate human text from machine text, a spam filter juggling billions of messages a day has little reason to bet its false-positive rate on the same signal.

What actually gets an AI-assisted cold email flagged

None of this means your AI-drafted email is safe by default. It means the thing that flagged it was never the model. Three causes explain almost every case. First, broken or missing sender authentication: no DMARC record, DKIM signed on a domain that doesn't match your From address, both failures that fire on every message regardless of who wrote it. Second, a structural fingerprint: a personalization paragraph stapled above an identical template body is what gets you caught, not the fact that AI generated the paragraph. The AI reply generator dilemma covers why that specific pattern, LinkedIn scrape plus generic template, has become recognizable to filters and readers alike within about fifty emails. Third, plain volume from a domain with no sending history, the same threshold outlook-cold-email-rejected walks through in Microsoft's own bulk-sender policy.

The fix has nothing to do with which app wrote your draft

Fix the three things that are actually checked and the "AI detector" panic stops mattering. Confirm SPF, DKIM, and DMARC pass and align to your From domain before you send anything at volume. Keep the message tied to something specific the recipient actually said or did, the anatomy that makes a message read as a reply instead of a blast, because that's what breaks the templated shape filters and humans both recognize. And keep your daily volume in the range a real triggered outbound program runs at, not the range that stopped converting for anyone years ago. Ask a model for help with any of that. Nothing you've read from Google or Microsoft says it's checking who typed first.

● FAQ

Does Gmail have a filter that specifically detects AI-written email?

Not according to Google's own documentation. Google's overview of how Gmail's spam filters work names IP and domain reputation, sender authentication, and user feedback as the signals in play. Content-generation method, whether a human or a model wrote the words, is not on that list.

What does RETVec, Gmail's AI spam model, actually detect?

Adversarial text manipulation: homoglyphs, invisible characters, and keyword stuffing that bad actors use to slip past classifiers. Google's security blog credits it with a 38% improvement in spam detection and a 19.4% drop in false positives against exactly those tricks. It was never built or described as an AI-authorship detector.

Isn't Microsoft using 'AI detection signals' in Defender for exactly this?

Microsoft's Defender blog uses that phrase for detecting campaigns that impersonate AI brands and tools, phishing kits pretending to be ChatGPT or Copilot, not for flagging whether a legitimate email was drafted with AI help. One campaign it names sent up to 100,000 impersonation emails in a single day. That's a different problem than a founder using ChatGPT to tighten a paragraph.

So why do AI writing detectors have such a bad reputation?

Because telling human text from AI text apart is still an open research problem. A Stanford study found that widely used GPT detectors consistently misclassify essays from non-native English writers as AI-generated, while flagging native-English writing accurately. If academic detectors built for exactly this task can't do it reliably, a spam filter has little reason to lean on the same signal.

So what actually gets an AI-assisted cold email flagged as spam?

The same three things that always have: a missing or misaligned SPF, DKIM, or DMARC record, a message that's structurally identical to thousands of others going out that day, and a domain with no sending history. None of that depends on which app opened when you typed the email.