Password reset email never arrives: email provider, ticket expiry, logs

Diagnose: password reset email missing

Symptom

"Forgot password" submits fine; nothing lands in the inbox.

Likely causes

1. Built-in Auth0 email provider: rate-limited, not for production, delivers slowly or not at all under load. Configure a custom provider (SendGrid, SES, Mailgun, SMTP).
2. Spam/junk, or corporate filters eating it. Check the provider's suppression/bounce list: one hard bounce suppresses future sends to that address.
3. Ticket expired or already used: reset links expire (configurable lifetime) and are single-use. Requesting twice invalidates the first link.
4. Wrong connection: the reset was requested against a database connection the user is not on (e.g. user is social-only; password reset is meaningless for them).

Confirm

• Tenant logs: look for the password reset request and email job events. "Sent" with no arrival = provider/deliverability. No event at all = the request never reached Auth0 (check the app's call).
• Email provider dashboard: bounces, suppressions, deferred queues.
• User Management > the user: which connection are they on? Social-only users cannot reset a database password.

Fix

Custom email provider, warm it up, monitor bounces. Set the ticket lifetime deliberately (short enough to be safe, long enough for slow inboxes). One active ticket per user; tell users to use the newest email.

Verify

Request a reset for a test user on the same provider and confirm arrival within a minute, link works once, second click fails cleanly.

Auth0's email provider docs describe the built-in provider limits and custom provider setup. Password change ticket lifetime is configurable in the database connection settings. Verified against live docs 2026-09-26.