Silent failure again
Nobody reports the reset email they never received; they abandon the account. Deliverability problems present as low conversion, support tickets about “nothing happened”, and no error anywhere in your logs.
Authenticate the domain properly
SPF, DKIM and DMARC on the sending domain are the baseline, and misconfiguring them is the most common cause of mail being filtered. If mail for the same domain is already handled elsewhere, records must be merged rather than replaced — a single wrong SPF record breaks your existing inbox.
One careless SPF edit can stop your company receiving email. Merge, never replace.
Separate transactional from marketing
Campaign mail attracts complaints; password resets must always arrive. Sending both from the same identity lets one damage the other, which is why a distinct sending subdomain for product mail is worth the setup.
Watch the bounces
Repeatedly mailing addresses that hard-bounce damages your reputation with receiving providers. Process bounce notifications and stop sending — which requires receiving webhooks reliably from whoever sends for you.
Log every send and its outcome
Message, recipient, timestamp, and provider response. When a customer says they never got it, that record is the difference between an answer and a shrug — and it is what logging is for.
Monitor the path, not just the code
A canary that periodically confirms mail still sends catches an expired key or a provider policy change before customers do. This is the same class of control as alerting when a scheduled job doesn’t run.