Password reset email that is not considered spam

Question

When my website sends emails to set or reset the password, they sometimes don't arrive at the recipient.

This problem does not arise for email addresses at large providers (as Google or Microsoft), but often email servers of schools or state institutions.

I guess that this is due to some bad spam filtering, where the email is just deleted without any notice to the recipient.

What I tried so far to reduce the problem:

• use a real email account, not something like sendmail
• start the email with "Hello X Y", where X Y is the real given name and surname of the addressed person.

But this had not the desired effect.

Answer 1

There is no magic bullet here. What's surprising to me is it's not the big orgs that are intercepting your email. I've found Google very prone to intercepting these kinds of emails.

A few things to look at:

• Make sure you have SPF records for your domain.
• Also set up domain keys. This is a little more complicated.
• Have a DMARC policy in place.

These tell the receiving server that the email is coming from a location that is approved to send email on behalf of the domain, and in the case of DMARC suggest a course of action for the receiving server.

When you get these set up, you should see an improvement. But ultimately you have no control over whether or not an email is delivered.

Answer 2

You have low delivery rate for your messages. This is a non-trivial problem. Profitable services like Mailchip, Brevo, and Constant Contact are happy to accept compensation in return for solving it.

There are lots of details, and you have gathered very few of them. We do not yet know whether your outbound MTA experiences greylisting delays, an immediate SMTP bounce, or a store-and-forward bounce / blackhole. You didn't even mention whether your MTA uses unique per-message envelope sender (SMTP "MAIL FROM:" verb), something which is pretty essential for understanding bounce behavior across a large population of recipients. You have not yet enlisted the aid of distant postmasters to understand what their server logged.

The technical details matter, and there are many of them. Seek professional assistance.

---

Consider offering multiple channels for credentials, such as an SMS phone number or an Authenticator app that generates pseudo-random digits. This will (A.) keep an existing customer happy with an automated action that yields instant gratification, and (B.) will reveal patterns about email suffixes which always opt for a non-email channel.

Answer 3

@GrandmasterB's answer already lists most of the things you can do. Alas, addressing the recipients by their full name would not help convince automated spam filters, so although it's certainly a good practice, it's probably not going to help.

I don't know your audience, but never underestimate the probability of them not looking at the obvious places (a spam folder etc.) or inadvertently deleting the e-mail themselves. Technical incompetence regarding e-mail is rampant, even among supposedly tech-savvy persons.

If mails are missing, your only option is to trace them step by step, and get the recipient to provide you with info that you can't access. You may want to give some information on your page where users request a new password about the timescale in which they should expect the mail in their inbox so they would contact you timely.

In the extreme, the providers of recipient's mailboxes may be able to help with logging info, but in my experience, their willingness might be pretty low.

Answer 4

The answers so far cover this pretty well given the limited information we have, but one thing to add: this is a worthwhile problem to attempt to solve rather than looking to outsource it to mail delivery companies that promise to solve it in exchange for money.

Unlike your current setup, which is non-spam that some poorly behaved recipient setups are misclassifying as spam, mail sent through one of these services is mail sent by a known spammer, and if it's blocked, it's being rightly blocked.

Moreover, and this is the really important part, password reset emails contain extremely critical secrets that can be used for account takeover. They should not be entrusted to sketchy providers of delivery services for spammers. In addition to possible incompetence by these services in protecting the confidentiality of mail sent through them - which is often not even considered a priority because the bulk of the service they provide is marketing junk - they are treasure troves for outside attackers and insider threats who want to intercept account credentials from services who outsource to them.