Why is my magic link email not arriving?
Check the spam folder first, then your sender domain's SPF and DKIM. Magic links expire after 15 minutes, and repeated requests hit a short cooldown.
Your member clicked Log In, entered their email, and now they're staring at an empty inbox. Magic link email delivery is one of those things that should just work — and usually does — but when it breaks, the member can't access their subscription and they're frustrated. Here's the complete diagnostic playbook.
Check the spam folder first (seriously)
Before anything else: magic link emails are sent through VeloCMS's email service, and they always come from the VeloCMS platform address — the custom sender domain you can verify on Business and Agency (Admin → Settings → Email) only changes the From address of other emails your blog sends, like order and booking notifications, not magic links. So the member should check their Spam or Junk folder and mark the email as 'Not spam' — this trains their filter for future emails.
Members sometimes search their inbox for your blog's domain and find nothing. Magic link emails come from the VeloCMS platform address with the subject 'Sign in to <your blog name>' — ask the member to search for that subject or the sender address instead.
Your sender domain doesn't affect magic links
On Business and Agency you can verify a custom sender domain under Admin → Settings → Email — DKIM, SPF, and DMARC records with a status of Pending DNS, Verified, or Failed, plus Refresh Status and Retry Verification buttons. That domain changes the From address of emails like order confirmations and booking notifications. Magic link emails always come from the VeloCMS platform address, so verifying or fixing your sender domain will not change where magic links land. If a magic link lands in spam, the fix is on the member's side:
- Mark the magic link email as 'Not spam' — one report usually trains the filter for future emails.
- Add the sender address shown on the email to their contacts — most providers deliver mail from contacts straight to the inbox.
- On a corporate mail system, ask their IT team to whitelist the sender address at the gateway.
- If you also send order or booking emails from your own sender domain, keep its DKIM, SPF, and DMARC records healthy so those emails keep landing — a failed sender domain there is a separate issue from magic link delivery.
Magic link expiry — 15 minute window
VeloCMS magic links expire 15 minutes after they were generated. If the member waited too long to click the link, it's invalid. The member needs to return to the login page and request a new link. The new link starts a fresh 15-minute window.
Magic links are single-use. Once clicked, the link is invalidated immediately. If the member gets a 'link expired or already used' error, they simply need to request a new one.
Cooldown — too many requests
If a member requests login links repeatedly in a short period, VeloCMS applies a rate limit to prevent email abuse. After 5 requests for the same email address within a minute, the login form shows 'Too many login requests for this email. Try again in Ns.' and the wait is never longer than 60 seconds. This is intentional — repeated requests usually indicate the previous emails landed in spam rather than a delivery failure.
Email arrived but the link is broken
If the email arrives but clicking the link shows an error page, the most common cause is a link-wrapping service modifying the URL. Some corporate email gateways (Proofpoint, Mimecast, Microsoft Safe Links) rewrite click links and can corrupt the token. Check the URL the browser navigated to — if it goes to a link.protection.outlook.com or similar URL instead of yoursite.com/member/verify, the gateway rewrote it. The member should copy the original URL from the email source and paste it directly into the browser.
Confirm delivery from the admin
As a blog admin, you can confirm that sending works by using Admin → Settings → Email → Test Send to send a test message to yourself. If it arrives, sending is fine and the problem is on the member's side: spam filtering, a mistyped address, or a block on their mail server. If it doesn't arrive, contact support with the member's email address and the time of the request.