Email API2 min read
Password Reset Email Best Practices (Deliverability + UX)
Template design, authentication, and timing for reset links that actually arrive.
Users locked out are already frustrated. Reset mail that lands in spam ends support tickets — and churn.
Quick summary
- Send immediately, through your transactional API rather than a queue shared with newsletters
- Send from your own domain with SPF, DKIM and DMARC passing
- Use a consistent From name and address so users recognise it
- Keep the message short and mostly text, with one link
- Use a random, single-use token that expires quickly — an hour or less is common
Make it arrive fast
- Send immediately, through your transactional API rather than a queue shared with newsletters
- Send from your own domain with SPF, DKIM and DMARC passing
- Use a consistent From name and address so users recognise it
- Keep the message short and mostly text, with one link
Make it safe
- Use a random, single-use token that expires quickly — an hour or less is common
- Invalidate the token once used, and when a new one is requested
- Never include the user’s password, new or old
- Show the same message whether or not the account exists, so the form cannot be used to check who has an account
- Link over HTTPS to your own domain, not a link shortener
What the message should say
- A clear subject such as “Reset your [Product] password”
- Who asked (the account email) and when the link expires
- “If you did not request this, you can ignore this email” — and how to contact support
- A plain-text version alongside the HTML
When users say it never came
Check the delivery log before anything else. OquMail records each API send with the receiving server’s response, so you can tell whether the message was accepted, deferred or rejected — and why.
Want to see how your own domain is set up? Use the free SPF checker and DMARC checker: they run in your browser and store nothing.