Google classify their own security alerts as spam. Or they just can’t be arsed with sorting out DKIM.