Reset Messages Now Arrive Reliably, Including in Gmail
Some people requesting a password reset never received the email. It is fixed. The cause was interesting enough to write up, because it was not what anybody assumed.
What we assumed
Deliverability. That is always the assumption, and it is usually right: a sending reputation problem, a missing authentication record, a shared address range with a bad history. We checked all of it. Authentication was correct, the sending reputation was clean, and the messages were being accepted by the receiving servers rather than bounced.
Accepted, and then not visible in the inbox. Which is a different problem entirely.
What was actually happening
Gmail groups messages into conversations by subject line and participants. Our reset email had used the same subject for years. For any user who had ever received one before, the new message was filed into the existing conversation, which by then was old, read, and archived.
The email arrived. It was delivered, it was in the account, and it was not in the inbox, because it had been threaded onto a conversation that was no longer in the inbox. Searching for it found it immediately, which is why the handful of people who thought to search never reported a problem.
The fix
The subject line changed, and reset messages now carry headers that explicitly mark each one as a new conversation rather than a reply. We also stopped reusing subject lines across any message where a missed delivery has consequences.
The general lesson
"The email did not arrive" and "the email is not in the inbox" are different statements, and conflating them cost us weeks looking at the wrong system. A message can be delivered successfully and still be invisible.
It is the same shape of problem as the one in the scanning fix: everything reported success, and the outcome was still wrong.
If you are still stuck
Search your mail for the sender rather than scrolling the inbox, and check the spam folder once. If nothing turns up, the contact form reaches a person who can help.
Related: notification preferences, which cannot be used to switch off account and security messages, for exactly this kind of reason.
Create your free actor website and use an address you actually check.
