How to find out why a user never got a login code, receipt or newsletter your app says it sent, from typos and suppressions to quarantines, spam and delays.
When key emails like login codes don't arrive, it blocks your users, clogs your support queue, and can often lead to churn or missed sales opportunities.
Why do emails not arrive? Most cases come down to 1 of 6 causes:
In this guide, we'll walk through each cause in the proper order to help you diagnose the problem.
Before you change anything, look at how many people are missing your emails and which email providers they use.
| Who's affected | Most likely cause | Where to look |
|---|---|---|
| A single user | A typo in the address, a suppressed address, or a quarantine at the user's company | Your provider's logs and suppression list, then the user's spam folder or quarantine |
| Users at a single email provider, such as Outlook or Hotmail | Your domain's reputation at that provider, often after a new domain or a jump in volume | Bounce and deferral messages from that provider |
| Users at a single company | The company's spam filter or security gateway | The company's IT team |
| Everyone | An unverified domain, broken authentication, or a bug in your sending code | Your provider's API logs and domain settings |
Identifying the group affected helps you understand the scope and identity of the problem. Authentication issues affect everyone at once, for instance, so when only one user is affected, start with the address and the logs.
"Sent" in your app and "in the inbox" are separate steps, and an email can stop at any point between them. Trace it from your code, to your email provider, to the recipient's mail server.
| Status | What it means |
|---|---|
| Sent | Your provider processed the email and is delivering it to the recipient's mail server. |
| Delivered | The recipient's mail server accepted the email. Where it goes next, inbox, spam or quarantine, is up to the recipient's provider. |
| Delivery delayed | The recipient's server deferred the email with a temporary error, such as a full inbox or rate limiting. Your provider keeps retrying. |
| Bounced | The recipient's server rejected the email. The bounce message explains why. |
| Suppressed | Your provider skipped the email because the address is on your suppression list. |
The more detailed your logging, the easier it will be to identify the problem. Gather timestamps and status data at each step to see exactly where an email got stuck in the process.
When a single user is affected, look at the address before anything else.
@privaterelay.appleid.com. Apple only forwards email to those addresses from domains and sender addresses you've registered with Apple. Everything else bounces."Delivered" only means the recipient's mail server accepted the email. From there, the recipient's provider decides where it goes, and it doesn't report back to you. A delivered email can still land in one of these places:
Ask the user to search all their mail, spam included, for the exact subject line. A subject line search finds the email faster than a search by sender name, and Microsoft's quarantine search also matches on the full subject.
Quarantine is a holding area that company email systems, such as Microsoft 365 and Google Workspace, use for messages they consider risky. Unlike the spam folder, quarantine sits outside the user's mailbox, so most users never see what's in it. The email system also deletes quarantined messages automatically after a set period.
B2B apps run into quarantine often, because login and invite emails from an unfamiliar sender look a lot like phishing to a security filter. A quarantined email needs a manual action:
security.microsoft.com/quarantine, and choose "Allow sender" for future emails. Messages quarantined as high-confidence phishing or malware can only be released by an admin.Releasing a message only delivers that one email. If later emails still end up in quarantine, ask the company's IT team to allowlist your sending domain.
When a customer's IT team asks how to allowlist your emails, give them your sending domain and your return-path domain, not IP addresses. The return-path domain is where bounces go, and it appears in every email's headers. Most email providers send from shared pools of IP addresses that change over time, so an IP allowlist breaks without warning.
Here's a message you can adapt and send:
Our records show your mail server accepted the email, but it didn't reach the recipient's inbox, which usually means your email system quarantined it. You can release it from quarantine, or a Microsoft 365 user can release it at security.microsoft.com/quarantine. To prevent this for future emails, please allowlist our sending domain,
example.com, and our return-path domain,bounces.example.com.
If the company's filters still quarantine your emails after the allowlist, the quarantine reason in their admin tools shows which rule caught them.
Phishing emails tend to be short: a line of text, a code or a link, and no context. Spam filters treat a login email with the same shape the same way. A few changes make yours easy to tell apart.
vercel.app, because spammers use them too, and a link domain that doesn't match your sending domain looks like phishing. Keep your website and your sending domain on the same root domain: don't send from myapp.app if your site is at myapp.com.auth.example.com and news.example.com.Most emails arrive within seconds, but some take minutes. Compare 2 timestamps to find out where the time goes: when your app sent the email, and when your provider reported it as delivered.
The first step is to identify where the delay is happening: in your app or the receiving mail server.
If the delay comes before "sent", the email is stuck in your app, often in a job queue behind bulk work. Give login codes and password resets their own queue, so a newsletter can't hold them up.
If the delay comes after "sent", the recipient's server is deferring you, and no code change on your end will fix it. Your email provider retries deferred emails automatically, and most of them arrive within the retry window. For more details, see the SMTP response, which explains the delay:
421 4.7.28 when it sees an unusual rate of email from you. Microsoft responds with 451 4.7.500 to 4.7.699, which it calls IP throttling and says resolves as you build a sending history over a few days.4.2.1 response means "the user you are trying to contact is receiving email at a rate that prevents additional messages from being delivered", and 4.2.2 means "the recipient's inbox is out of storage space."Even after your provider marks an email as delivered, some inbox providers take a few more minutes to process it before it appears in the inbox. If slow deliveries follow a pattern, look at which inbox providers they have in common.
Internet providers and regional email services, such as Comcast, AT&T, Orange, T-Online and GMX, are often harder to reach than Gmail or Outlook. Their spam filters can be stricter, and they rarely offer reporting tools like Google Postmaster Tools to show how they rate your domain. When users at one of them keep missing your emails, contact the provider's postmaster team directly.
University addresses, often ending in .edu, sit behind some of the strictest inbound filters. Expect the same kind of quarantine and allowlist conversations as with B2B customers.
The same checks apply to newsletters, with a few additions:
You can prevent most of these tickets on the screen users see right after you send the email:
Give support agents the same resend button for receipts, invoices and confirmations, wired to the function that sent the original.
A help article for users who aren't getting your emails saves your support team time. List your sender name and a typical subject line so readers can copy them into a search, ask them to check spam and other tabs, and ask users with a work address to check their quarantine or contact their IT team. If none of that works, ask them to contact you, so you can check whether the email bounced or landed on your suppression list.
When a single user is missing an email, leave your DNS records alone. Your authentication records (SPF, DKIM and DMARC) apply to a sending domain, so a broken record can affect all mail sent through that domain. Editing your records to fix one user's problem can break delivery for other users of that domain.
Find out which emails generate the most tickets. People tend to reply to the email itself, so searching your support inbox by subject line shows which emails need work first.
Don't wait for users to tell you. Alerts on bounces and delivery delays show a problem with a provider or a domain before your support inbox fills up.
id the Send Email API returns, and look the email up on the Emails page or with the Retrieve Email API. Each email's event timeline shows whether it was sent, delivered, delayed, bounced or suppressed.email.delivered, email.delivery_delayed, email.bounced and email.suppressed webhooks to show a status on your "check your email" screen, or to alert your team.What's the difference between quarantine and the spam folder?
The spam folder is part of the user's mailbox, so they can open it and move your email out. Quarantine belongs to their organization's email system and sits outside the mailbox, often where only a separate portal or an admin can reach it. The system deletes quarantined messages automatically after a set period.
Do Hide My Email, Firefox Relay, or DuckDuckGo addresses change anything?
Mostly no. Relay services forward your email to the user's real inbox. The exception is Sign in with Apple: its privaterelay.appleid.com addresses only accept email from domains and sender addresses you've registered with Apple.
How do AI inbox features handle login codes and receipts?
Inbox providers are adding summaries and code detection, and there's no standard yet for marking an email as a one-time code. Keep the code and its purpose clearly visible near the top of the email, in plain text.
Why did some people get my newsletter twice?
The reader probably subscribed with 2 addresses that lead to the same inbox, such as an alias and their main address. Both are valid, so both get the newsletter.
Why are my emails grouped into one conversation in Gmail?
Gmail can group emails with the same subject into one conversation, so a new login code ends up hidden under older ones. Give each email a distinct subject, for example by including the order number. You can also give each email an X-Entity-Ref-ID header with a unique value, such as a UUID, which stops Gmail from grouping them.