Magic link email not arriving — Resend domain verification checklist
If your readers aren't receiving magic link login emails, the most common cause is an unverified Resend sender domain. Here's the full diagnostic checklist and how to fix each issue.
Magic link emails failing to arrive almost always trace back to one of three root causes: the Resend sender domain is not verified (the most common), the DNS records for SPF/DKIM are missing or propagating, or the reader's email provider is blocking the sending IP. Here's how to diagnose and fix each.
Check 1 — Is the Resend domain verified?
Log in to app.resend.com and navigate to Domains. Your sending domain (the one set in RESEND_FROM_EMAIL) should show a Status of 'Verified' with a green tick. If it shows 'Pending' or 'Failed', the DNS records have either not propagated yet or are incorrect. Resend requires three DNS records: an SPF TXT record, a DKIM CNAME record, and a DMARC TXT record. All three must be present and error-free.
# DNS records required by Resend:
# SPF (TXT on @):
v=spf1 include:amazonses.com ~all
# DKIM (CNAME on resend._domainkey):
resend._domainkey.yourdomain.com -> em.yourdomain.resend.com
# DMARC (TXT on _dmarc):
v=DMARC1; p=none; rua=mailto:[email protected]Check 2 — Test with a different email address
Send a magic link to a Gmail address and to an Outlook/Hotmail address. If both fail, the issue is the sending setup (domain verification or Resend API key). If Gmail works but Outlook fails, the issue is reputation-based (Microsoft's filters are stricter). If neither works, check the Resend logs — app.resend.com Logs — for bounce or block records against the reader's address.
Check 3 — Is the RESEND_FROM_EMAIL matching the verified domain?
VeloCMS sends member magic links from the address in your RESEND_FROM_EMAIL environment variable. The domain of that address (the part after @) must match a Resend-verified domain. If RESEND_FROM_EMAIL is [email protected], then yourblog.com must be the verified Resend domain. A mismatch — even by a subdomain — causes Resend to reject the send request silently.
The Resend dashboard Logs section shows every send attempt, including those that were accepted at the API level but blocked downstream. Filter by the recipient's email address to see the full delivery trail, including any soft or hard bounces.
Check 4 — Rate limiting and cooldown periods
VeloCMS rate-limits magic link requests to 3 per hour per email address to prevent abuse. If a reader has requested more than 3 links in the past hour, the fourth request is silently dropped. The reader sees 'Check your inbox' but no email is sent. Ask the reader to wait 60 minutes and try again. If the issue persists after the cooldown, it's not rate limiting — move on to the Resend logs check.