How are bad actors using Google Forms to send spam?
Updated on 21 Oct 2026: We clarified Google Forms receipt abuse, direct credential theft, and the limits of DMARC protection.
Bad actors use Google Forms to send spam by making Google generate the email for them. They publish and share a form with a target, submit a form with the target's address as responder input, or release a quiz score to that address. The lure goes in the form title, optional notification, field values, answer feedback, or linked destination. Google Forms then delivers a sharing notification, response receipt, or score email. The message can pass SPF, DKIM, and DMARC because Google sent and signed it, even though user-supplied content is unwanted or deceptive.
These messages abuse legitimate platform workflows. Authentication validates domain use; it does not establish that the form creator is trustworthy or that the recipient expected the message.
Authenticated does not mean safe
A Google Forms message can be genuine Google mail and still be spam. The abuse sits in the payload that Google was asked to send, not in a forged sending domain.
How attackers send spam through Google Forms
The core trick is simple: Google Forms has legitimate workflows for sharing published forms and emailing response or quiz results. Attackers use those workflows at scale, then place the suspicious part where the recipient sees it. The visible message often looks like a normal Google notification, so some recipients trust it before checking the form title, supplied answer, phone number, or linked destination.
Google Forms email invitation dialog with recipient and message fields.
The same idea appears in several forms. Each route leaves a different clue in the headers and body. Google's sharing instructions confirm that published forms can send responder notifications with an optional message.
- Published-form notification: The attacker shares a published form with the target as a responder and puts the lure in the title, description, or optional notification message.
- Response receipt: The attacker uses manually entered responder email addresses and response-copy settings to request a receipt at the target's address. Receipt delivery is subject to spam filters and anti-abuse checks.
- Quiz score release: The attacker records the target's address on a quiz response and uses Release score to trigger an email. The score notification or linked quiz results carry the lure.
- Reflected fields: The attacker places spam text inside answer fields that are copied into the email received by the target.
- External destination: The Google-hosted form contains a link or QR code that routes the recipient to a separate page.
- Callback phishing: The form claims there is an urgent charge or account problem and tells the recipient to call a number controlled by the attacker.
- Brand confusion: The message benefits from Google's sender reputation while its content impersonates a bank, employer, school, or payment service.
Receiving a response receipt does not prove that you completed the form. Google's response settings distinguish Responder input, which accepts a manually entered address, from Verified, which collects the signed-in Google Account address. That distinction explains how someone can receive a receipt for a response they never submitted.
Google Forms spam workflow showing Google-generated email passing authentication before reaching a recipient.
One reason this catches people is that the trust signal is split. The sender line says Google, the authentication results identify Google, but the call to action comes from the form creator or a submitted answer. Look for wording that asks the recipient to leave the form, make a payment, submit credentials, approve a file, or call a phone number.
How Google Forms phishing collects passwords
A Google Form can be the credential-harvesting page itself. Attackers ask for passwords or one-time verification codes in form questions, so the recipient never needs to leave Google's website. Stanford University's phishing alert documents Google-hosted forms requesting university passwords and two-factor authentication passcodes.
A genuine account sign-in screen is separate from questions written by a form creator. Never type a password or MFA code into a Google Form question. HTTPS encrypts the connection; it does not stop the form owner from reading submitted answers.
- Verify requests for bank details or payment through a known contact before submitting information, even when the form has familiar branding.
- Treat unexpected forms presented as unsubscribe pages with caution. Use the inbox's spam or phishing report controls instead of submitting more personal information.
Attackers also distribute Google Forms links through ordinary email, including compromised accounts. In those cases, evaluate the actual email sender separately from the Google-hosted form.
Why SPF, DKIM, and DMARC pass
SPF and DKIM can pass because Google authorized the sending IP and signed the message. DMARC checks domain alignment and needs a matching pass from either SPF or DKIM. RFC 9989 makes clear that a DMARC pass validates domain use, not message safety. The problem is that an attacker induced a trusted platform to carry unwanted content.
Illustrative authentication results, not a complete headertext
From: Google Forms <forms-receipts-noreply@google.com> Authentication-Results: mx.example; spf=pass smtp.mailfrom=google.com; dkim=pass header.d=google.com; dmarc=pass header.from=google.com
Sender addresses vary by workflow; the example is not a sender allowlist. Read the Authentication-Results added by your receiving mail system. Attacker-supplied header lines can contain false pass results.
If your domain appears only in the form title, body text, or claimed brand, its DMARC policy is not evaluated for the Google From address. Your DMARC monitoring still matters because receiver reports can reveal other messages using your domain in the visible From address. Mail sent as Google does not appear in your domain's DMARC reports merely because it mentions your brand.
|
|
|
|
|---|---|---|---|
SPF | Pass | IP authorized for envelope domain | Content and author intent |
DKIM | Pass | Google-domain signature verified | Safety of user-supplied content |
DMARC | Pass | Passing SPF or DKIM domain matches visible From under DMARC rules | Whether the payload is deceptive |
Authentication result versus what it proves
Domain spoofing and platform abuse
A domain-spoofing message forges the visible From domain. A Google Forms abuse message can authenticate its Google sender while carrying deceptive form content.
The same review applies to lookalike-domain concerns. A lookalike domain can pass authentication for itself. Compare the authenticated domain with the organization being impersonated; a pass result alone does not establish that connection.
What to check when a message looks authentic
Do not stop at a pass result. Read the headers and body together, then decide whether the message is legitimate Google workflow mail, unwanted Google-generated spam, or a separate spoofing attempt.
- Visible From: Check whether the sender is Google, a lookalike domain, or a domain your organization owns.
- Authentication domains: Compare the SPF envelope domain and DKIM signing domain with the visible From domain, using results added by the receiving system. A passing Google domain with suspicious form text points to platform abuse.
- Form URL: Inspect the hostname and the form's questions as well as every external destination. A genuine Google-hosted form can still collect passwords or other sensitive information.
- Reflected text: Find content that came from a form answer, quiz feedback, or optional sharing message rather than a standard Google notice.
- Recipient path: Confirm whether the recipient expected a form share, requested a response copy, completed a quiz, or was added without consent.
- Volume pattern: Look for repeated subjects, form IDs, destination domains, or bursts sent to shared inboxes and public aliases.
For a suspicious sample, preserve the original message and inspect its headers in the receiving mailbox. Forwarding changes the delivery path and can change authentication results. To check your own sending setup, send a new, non-sensitive message to Suped's email tester; its result checks that test message and does not certify a Google Form as safe.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
If the same organization is also seeing a broader rise in inbox junk, separate Google Forms abuse from general Gmail inbox spam. The controls overlap, but the evidence trail is different.
What to do if you interacted with the form
The response depends on what happened after the email arrived. Preserve the message and form details first, then contain the specific exposure without revisiting links or using contact details supplied by the form.
- Preserve evidence: Keep the original email, complete headers, form URL, form ID, screenshots, phone number, and linked destination before reporting it.
- Secure exposed accounts: If credentials or MFA codes were entered, open the real service through a known address, change the password, revoke active sessions, and review recovery settings and MFA methods. Enable MFA if it is not already active.
- Protect payment accounts: If card or bank details were shared, contact the provider through a verified number and follow its fraud-containment process.
- Contain device access: If a download ran or remote-access software was installed, disconnect the device from the network and have the security team examine it before reuse.
- Notify the organization: Send the preserved sample to the security team so it can find other recipients, block confirmed destinations, and determine whether an account was compromised.
- Report the form: As a responder, use Help at the bottom left, select Report, choose the abuse type, and submit the abuse report. Follow Google's reporting instructions. Also report the original email as spam or phishing in the inbox.
Use a separate contact path
Verify any claimed charge or account issue through a known website, saved app, or number printed on an official statement. Do not call the number in the form.
How to reduce Google Forms spam risk
There is no DNS-only fix for abuse of a real Google product. The practical response combines user education, content filtering, header review, and domain authentication monitoring. Split the work according to who owns each control.
For recipients and security teams
- Filter context: Flag unexpected Google Forms mail to finance, payroll, executives, and shared inboxes.
- Inspect destinations: Treat shortened links, QR codes, off-platform pages, and callback numbers as separate risk signals.
- Verify requests: Confirm urgent requests through a known business channel instead of replying or using form-supplied details.
- Keep evidence: Preserve headers and body content before reporting or deleting the message.
- Report abuse: Use the form's Help > Report path and send the evidence to the workspace administrator.
For domain owners and senders
- Monitor DMARC: Review reported sources using your domain for signs of a separate spoofing campaign.
- Review senders: Keep approved mail sources authenticated so real failures stand out quickly.
- Watch reputation: Use blocklist (blacklist) checks when investigating your own sending domain or IP, rather than incoming spam volume alone.
- Stage policy: Move DMARC policy forward only after legitimate sources are authenticated.
Suped is our DMARC and email authentication platform. On the domain-owner side of this problem, it groups reported sending sources using your domain and highlights authentication failures that need investigation. Those reports do not identify brand impersonation inside Google-sent form content.
Issue steps to fix dialog showing the issue overview, tailored fix steps, and verification action
Keep reputation checks separate: blocklist monitoring checks domain or IP listings. A domain health check reviews authentication records; it does not assess the safety of a form.
Separate inbox and domain controls
- Inbox controls: Use content and URL rules for unexpected Google Forms mail.
- Domain controls: Use Suped to monitor DMARC, SPF, DKIM, blocklists, and source changes.
- Response controls: Escalate samples with headers, form IDs, destination links, and recipient patterns.
Limits of filtering Google Forms
Blocking every Google Forms message sounds simple until a real business process breaks. Surveys, intake forms, event registrations, hiring workflows, support requests, and school forms all use the same product family. Google-hosted forms share hostnames, so a domain-only rule cannot distinguish an approved form from an abusive one. HTTPS encrypts traffic but does not validate the form creator. Target unexpected or risky use instead of all Google Forms mail.
Suggested actions for Google Forms messages
Illustrative triage guidance, not measured detection confidence. Review the form's questions as well as its links.
Low confidence
Review
The form is expected and the requested information fits a verified business process.
Medium confidence
Quarantine
The form is unexpected and uses urgency or requests sensitive information.
High confidence
Block
The form requests passwords or verification codes, or matches a confirmed abusive campaign.
Google began automatically upgrading older forms to granular responder access controls in December 2025, according to Google's Forms update documentation. A published form can be shared with named responders and send an email notification. Those controls govern access to the form. They do not validate its requests for information or linked destinations.
Receiving Google Forms spam does not by itself put your domain or IP on a blocklist (blacklist). Investigate your own sending activity if separate evidence shows account compromise or unauthorized mail.
Practical checks for Google Forms spam
Best practices
Inspect the DKIM signer and visible From before trusting a message that passed authentication.
Track sudden Google Forms bursts by recipient, subject text, and linked form destination.
Tune filters on form context and user expectation, not on Google authentication alone.
Common pitfalls
Blocking all Google Forms mail breaks real workflows for surveys, hiring, and support fast.
Treating DMARC pass as intent proof lets platform-generated spam reach users unchecked.
Ignoring form titles and field values misses the text the recipient actually sees first.
Expert tips
Build a review path for Google Forms messages sent to finance and executive aliases.
Use DMARC data to confirm whether your own domain is being spoofed in parallel too.
Correlate spam complaints with form-link patterns before tightening filters across teams.
