Why Magic Link Emails Fail: Deliverability Issues in Passwordless Authentication

It’s easy to see why businesses offer magic link logins. Passwords get forgotten, reset requests take time, and users don’t particularly enjoy either. 

Sending a login link by email seems like a reasonable way around all that.

But the devil is in the details, as they say. The email itself now becomes part of getting into the account. If it doesn’t arrive, the user can’t finish signing in, even when everything on your website appears to be working.

Asking users to check their spam inboxes or reconfiguring email spam filters and trying all over will likely cost you plenty of potential customers. It’s too complicated for an average user.

Fixing the main issues in the delivery seems like the best approach. But what actually goes wrong with the delivery? 

Below, we’ll walk through the main reasons magic link emails fail, separate email delivery issues from problems with the links themselves, and explain how to improve their chances of reaching the users’ inboxes.

What are magic link emails, and how do they work?

Magic link email is a conversational name for emails that are sent to users to allow them passwordless access to a site or resource. More technical alternatives to the term include “passwordless login link” or “email sign-in link.”

Passwords are difficult, mainly because they take effort to remember. That’s why businesses turn to passwordless authentication solutions, including magic links. Here is how it works step-by-step (the simplified version):

1. You enter your email address on the login page.
2. The service creates a temporary login and sends you a link in an email (magic link login email) containing it.
3. You click the link, and the system performs a quick check for valid access.
4. If the check succeeds, you’re signed in.

Such a link usually expires after a certain, limited (usually a few minutes) time and is valid for one-time use only.

You can see the complete process in this illustration:

The key word in this whole story is “passwordless,” but it doesn’t mean there’s nothing left to protect. Someone who gains access to your inbox may also use the login links sent there. That’s where two-factor authentication can make a big difference and not only save your account, but also protect your passwordless login.

For the business sending these emails, reliable delivery is just as important. If the message never reaches the user, the login process stops before they can access the service. 

Why magic link emails fail to reach the inbox

When you entrust your app to handle the user authentication process, it’s tempting to assume that everything will go smoothly. It’s a pure technical process, after all, devoid of any human error. But there are several places where things can go wrong.

Let’s start with the receiving server and its routine technical checks that decide whether your email can be trusted.

SPF, DKIM, and DMARC configuration issues

A familiar sender name isn’t a guarantee that your email will receive a warm welcome by the recipient servers’ verification system. Anyone can copy a name. Receiving servers need something more than just a name, something they can actually check.

That’s where SPF, DKIM, and DMARC policy come in:

• SPF identifies authorized sending servers.
• DKIM adds a digital signature that helps verify the message.
• DMARC checks whether a passing SPF or DKIM result aligns with your visible sender domain.

Three technical checks, one decision to accept or reject your email (or send it to spam).

Moreover, even if your regular business emails work perfectly well, your login emails may fail the final DMARC check.

To see where the problem lies, you can simply use email deliverability tools and run regular checks. Check SPF, DKIM, and DMARC settings and test whether your emails reach the inbox. Besides, make sure you test an actual login email, as it may use a different sending setup than your regular emails.

Poor IP and sender domain reputation

Before we even move on to email content as a potential deliverability issue factor, there is something far more apparent to consider: the reputation of a sender’s domain and IP address. To some extent, it’s even more important (at least it comes before) than those technical checks that we discussed in the previous chapter.

To assess reputation, mailbox providers look at what’s been coming from your domain and sending IP:

• Have recipients been marking those emails as spam? 
• Has the IP been used to send unwanted messages? 

These things influence how future emails are treated, including emails containing your magic URLs.

Besides, you might not be the only business using that IP. Many email sending services put multiple customers on shared infrastructure. You’d be lucky if the other sharers of that IP have a better reputation than yours, but that is not always the case. Their tarnished reputation will inevitably damage your shared IP’s reputation, 

The result? Your login emails can get caught up in the filtering, too.

Spam filters and suspicious email content

Spam filters don’t always work as intended. Their algorithms are subject to review with every major operating system or security patch update. So, if you keep receiving email magic links for months, it doesn’t mean that the next month it won’t end up in your spam inbox.

What email spam filters essentially do is that they scan for suspicious email content:

• Misleading subject lines that pressure users to act immediately.
• Linked domains associated with spam or phishing.
• Unexpected attachments that have no purpose in a login email.
• Promotional offers mixed into a message with a magic link.

Some spam filters are very sensitive to detection of links that hide their destination behind URL shorteners or several redirects. This is not an exhaustive list, as there might be other reasons for spam filters to block an email.

Of course, having a link or an urgent phrase doesn’t automatically make email spam. Email spam filters consider several signals together, including the sender’s reputation. But unnecessary additions can make a legitimate login message look less trustworthy.

If your login emails include an automatically added signature, check that part of the message, too. Besides introducing extra links and images, a signature added after DKIM signing can cause email authentication issues by changing content that was already signed. 

Why email magic links can fail even after delivery

A delivered email looks like a successful outcome on a dashboard. For the customer, success means getting into their account. There’s still a step between those two events, and it doesn’t always go smoothly.

Expired links and repeated login requests

Customers do not schedule their day based on when they receive the email about getting access to their account. When an access request is sent, the customer may receive a telephone call and get distracted for a while. When the customer wants to get into their account again, the email has been delivered, but the magic URL has already expired.

This is the expected behavior for a temporary link. Nevertheless, the situation becomes frustrating when the customer hardly gets any chance to use it due to the long waiting period during delivery.

In addition, sending repeated requests can result in yet another form of ambiguity. Depending on how the sending system works, every time you click ‘send’ on a re-send button, it cancels the previous link, sending you multiple near-identical e-mails, making you think about which one is valid… or not.

When you try to open an old message, you might end up trying to use a canceled link; and if you send yet another request, then you add yet another link on top of all those other confusing links. Familiar pain, isn’t it?

Security scanners that consume single-use links

Some security scanners are more thorough than the others. It’s a classic situation when better is the enemy of good, i.e., when a security system, instead of just scanning the email contents and checking the sender’s domain, actually opens all links that this email contains.

It doesn’t take a genius to understand what happens in this case with a magic link email. The link it contains is only valid for a single use. Therefore, the security system virtually steals your right to use that link, and the link expires before you even open it.

When it happens, sending another email may not help. The replacement goes through the same security checks and can become unusable for exactly the same reason.

Some other common magic link failures after delivery to user inbox, include context switching (a user has to switch between various applications, which is especially painful on mobile), and cross-device failure (when switching between different devices):

How to improve magic link email deliverability

Knowledge is power. We have deliberately dedicated so much time and space to explain all the possible things that could go wrong and cause magic link login failure. Now, let’s look at how to fix email delivery problems that keep users from accessing their accounts.

One thing that needs to be clarified upfront: there isn’t one setting that will fix every delivery problem. But you can certainly make your login emails more reliable by getting these four things right:

1. Check your authentication setup. Configure SPF and DKIM, then verify that at least one passes with the domain alignment needed for DMARC. If your business email and login emails share a domain, test each sending setup separately.
2. Separate login emails from marketing. Make your login emails as clean as possible. Avoid mixing them with promotional content, and especially avoid including any additional links. 
3. Keep the email focused. Don’t write long texts in magic link emails. The longer the text, the higher the chances that a spam filtering system or a security app will find something suspicious in it. 
4. Look beyond delivery rates. Track your magic link email deliverability and use your findings to improve its performance. Things to watch for: how quickly messages arrive, bounces, and inbox placement across the mailbox providers your customers actually use.

Pro tip: Check whether your email service provider adds click tracking to login links and request to remove it if it does. Click tracking can replace the original URL with a tracking redirect, which adds another place where things can go wrong. Click tracking is not needed for login emails anyways.

Conclusion: Make reliable delivery part of passwordless authentication

Magic links in passwordless authentication emails might fail for any reason. Some technical, other human-related.

As a sender, you shouldn’t stop investigating the progress even when your mail client’s dashboard says “delivered”. Make a discretionary effort and go through the login process yourself, checking the points where your customers get stuck. You’ll be surprised how many findings you’ll get and how many things you can do to improve your email delivery process.

Your customers shouldn’t need to understand any of this. They requested access to their account, and the login process should make that a straightforward task.

Frequently asked questions

Are magic links safer than passwords?

Magic links are safer than passwords in one thing: they remove the known vulnerability when users choose weak passwords or reuse the same passwords across multiple accounts. But they introduce another vulnerability: someone accessing the recipient’s email account and abusing their access rights.

How long should a magic link remain valid?

There is no universal, fit-all open window. A magic link should give a user enough time to open their email client, read the email’s text, find the link, and click on it. You should take into consideration the delivery delays and the sensitivity of the account when choosing that time limit.

Does passing DMARC guarantee inbox delivery?

No, it doesn’t. Passing DMARC simply helps confirm that the visible sender domain aligns with a domain authenticated through SPF or DKIM. Besides DMARC policy, there could be other reasons why delivery might fail, e.g., tarnished sender reputation, spammy message content, hidden links, or just too many links in a single email.

What should users do if a magic link email never arrives?

The first thing to do is to check their spam folder, as this is where most failed magic emails are to be found. Another common issue is a mistake in an email address if they enter it manually. If these two steps don’t work, request a fresh link, but don’t repeatedly press send. If nothing arrives, contact the service’s support team or use another sign-in option if available.