Why is my magic link email not arriving?

Your member clicked Log In, entered their email, and now they're staring at an empty inbox. Magic link email delivery is one of those things that should just work — and usually does — but when it breaks, the member can't access their subscription and they're frustrated. Here's the complete diagnostic playbook.

Check the spam folder first (seriously)

Before anything else: magic link emails from VeloCMS are sent via Resend using the from address you configured in Admin → Settings → Email. If your sending domain isn't fully verified (SPF + DKIM), Gmail, Outlook, and Apple Mail will route the email directly to spam. The member needs to check their Spam or Junk folder and mark the email as 'Not spam' — this trains the filter for future emails.

The from address must be on a domain you control and have verified in the Resend dashboard. Sending from a Gmail or Outlook address as your blog email will almost certainly result in spam filtering because you can't add SPF/DKIM records to Gmail's domain.

Verify your sending domain's SPF and DKIM records

Go to the Resend dashboard → Domains → your domain. You'll see a checklist of DNS records to add. There are three types: an SPF TXT record, a DKIM CNAME record, and an optional DMARC record. All three should show a green checkmark. If any show orange or red, the record is either missing or not yet propagated.

SPF: Add TXT record at @: v=spf1 include:_spf.resend.com ~all. If you already have an SPF record, add include:_spf.resend.com inside the existing record rather than creating a duplicate — two SPF records breaks SPF validation.
DKIM: Add the CNAME record Resend shows you. The name is resend._domainkey.yourdomain.com and it points to a Resend-provided value.
DMARC: Recommended but not required. Add a TXT record at _dmarc.yourdomain.com with value v=DMARC1; p=none; rua=mailto:[email protected] to start in monitoring mode.
DNS propagation takes 5–30 minutes. After adding records, click 'Verify' in the Resend dashboard and wait before assuming the records are wrong.

Magic link expiry — 24 hour window

VeloCMS magic links expire after 24 hours from the moment they were generated. If the member waited too long to click the link, it's invalid. The member needs to return to the login page and request a new link. The new link starts a fresh 24-hour window.

Magic links are single-use. Once clicked, the link is invalidated immediately. If the member gets a 'link expired or already used' error, they simply need to request a new one.

Resend cooldown — too many requests

If a member clicks 'Send me a login link' repeatedly in a short period, VeloCMS applies a rate limit to prevent email abuse. After 3 requests in 5 minutes, the login form shows a 'Please wait before requesting another link' message. The cooldown resets after 5 minutes. This is intentional — repeated requests usually indicate the previous emails landed in spam rather than a delivery failure.

Email arrived but the link is broken

If the email arrives but clicking the link shows an error page, the most common cause is a link-wrapping service modifying the URL. Some corporate email gateways (Proofpoint, Mimecast, Microsoft Safe Links) rewrite click links and can corrupt the token. Check the URL the browser navigated to — if it goes to a link.protection.outlook.com or similar URL instead of yoursite.com/member/verify, the gateway rewrote it. The member should copy the original URL from the email source and paste it directly into the browser.

Resend logs — confirm delivery

As a blog admin, you can check Resend logs to see whether the email was actually sent and delivered. Go to the Resend dashboard → Logs and search for the member's email address. The log shows the send attempt, delivery status, and any bounces or complaints. If the log shows 'Delivered' but the member doesn't see the email, the issue is on the recipient's mail server. If the log shows no send attempt at all, check Admin → Settings → Email → Test Configuration.