auth · tutorial
Resend Magic Links Hit Spam? Fix It With DNS
Magic links land in spam without SPF, DKIM, DMARC, and single-use tokens. The DNS-plus-code deliverability checklist. Records inside.
The login email nobody receives
A user requests a magic link. It never arrives. Or it lands in spam an hour later, expired.
They try again. Three links now. They click the oldest first, and conclude your app is broken.
Support hears "login doesn't work" every week. The app works. The email infrastructure delivers to spam with perfect reliability.
A magic link is only as good as its delivery. And delivery is DNS records and sending hygiene. Not code.
Deliverability failures and what they cost
| Failure | The user sees | The cost |
|---|---|---|
| No SPF, DKIM or DMARC | The spam folder | Login impossible for most |
| A shared sending domain | Throttled alongside spammers | Random delays |
| Long-lived tokens | It works, until it is abused | A replay window |
| Multi-use links | Oldest-link confusion | "Broken" verdicts and tickets |
| Marketing and auth on one address | Auth flagged with promos | Login dies with campaigns |
Email auth fails silently. Three reasons.
Gmail and Yahoo enforce authentication. Missing SPF, DKIM or DMARC means spam or reject at the major providers. That is most of your users, by definition.
Token UX punishes confusion. Several requested links, each single-use, and the user clicks the oldest. Telling people which email to use, and how long the link lasts, is part of the feature.
Reputation is shared until you separate it. Send auth from a marketing-mixed address and one promo blast's spam complaints throttle tomorrow's logins.
What to do
Authenticate the domain fully. Then verify before you send.
Add the records your email provider gives you for your own domain. You need all three.
- SPF says which servers may send for your domain.
- DKIM signs each message so receivers can check it was not altered.
- DMARC tells receivers what to do with messages that fail, and where to send reports.
Wait until the dashboard shows all three verified. Only then send your first sign-in email.
Give sign-in mail its own address.
One address for sign-in only, never shared with anything louder. If receipts and campaigns use different addresses, a marketing complaint spike cannot slow tomorrow's logins.
Keep the email short and plain.
What it is.
The button.
A line that says to ignore it if you did not ask.
And keep a second door open.
Google sign-in beside magic links. When email is slow, or a provider has an incident, people still get in.
The deliverability drill
| Check | Action | Pass looks like |
|---|---|---|
| DNS green | Check your provider's dashboard | SPF, DKIM and DMARC verified |
| Inbox placement | Send to test accounts at the big three | Inbox, not spam, in all three |
| Single use | Click the same link twice | The second click is rejected |
| Second door | Sign in with Google | Works without email |
Run it monthly, and after any change to your email setup. Email is infrastructure with moods. Monitor the moods.
Skim your DMARC reports weekly. Failure rates and unfamiliar senders show up there first.
What it costs
An hour of setup. A few minutes a week.
You skip password infrastructure entirely.
No hashing.
No resets.
No stored passwords to leak.
Know this first
BoringPush does not retry sign-in emails if your provider is down. It adds no rate limits on link requests. It does not read your DMARC reports.
Deliverability is DNS and hygiene. Those are yours.
Why BoringPush is the way to do this
Email sign-in that arrives.
BoringPush sends a short, branded link through Resend. It lasts 24 hours and works once. Google sign-in sits beside it as a second door.
If email is slow, people still get in.
FAQ
How is magic link deliverability different from newsletter deliverability?
The stakes. Auth emails are expected, so users sit and wait for them, and a failure blocks sign-in at once.
Newsletters tolerate the occasional spam-folder landing; logins tolerate none. That is why they get separate addresses and separate reputations.
What should the magic-link email say?
Four things: what it is, how long it lasts, what to do if you did not ask, and the link. Keep it plain with minimal design. The email delivers a key, so clarity converts and design distracts.
Should magic links work across devices?
Yes. A person often requests a link on a laptop and opens it on a phone.
The link belongs to the email, not the device, so that flow works. Protect against abuse with request limits at your edge, not by breaking the flow real users like.
How do I stop people probing which emails have accounts?
Return the same response whether or not the email is registered, such as "if an account exists, a link is on its way". Instant "no account" feedback is an oracle that attackers automate.
What happens when the email provider has an outage?
New links may be delayed. Point people to the Google door while it lasts. The kit does not retry sends on its own, so a status message on your login page helps.
When should I add two-factor authentication?
When admin or high-value accounts demand it. BoringPush does not ship two-factor sign-in today, so plan for that work. For ordinary users, magic links plus Google are two good doors without extra friction.
Keep reading
- Next.js Auth in an Afternoon: Google + Magic Links — the auth setup this deliverability serves
- Stale Sessions Bounce You Forever (One-Rule Fix) — the session landing after link success
- One Auth Flow, Three Databases, Zero Forced Logouts — the user rows links resolve to
+ all the boring stuff (analytics, auth, SQLite ↔ Supabase, full marketplace, webhooks)
Command from your phone.
Built so autonomous AI agents build what you want without breaking what's already paying you.
- Built-in analytics — cookie-free mode, $0 forever, no PostHog bill
- SQLite ↔ Supabase: one setting, same field names
- Full digital marketplace & feedback boards included
- 3 payment rails: Stripe, LemonSqueezy & Dodo Payments
- Agent fences: lint gate, read-only data access, auto-rollback
- Ship from your phone via SSH & WireGuard/Tailscale in under a minute
$199
Get BoringPushOne-time payment · Lifetime updates · Unlimited projects.
Keep reading
