Use cases: OTP emails · Password reset · Order confirmations

Password reset emails

Transactional email with Vaartix

Why it matters

• Someone who can't reset their password can't use your product, and often writes to support instead.
• Reset emails are a favourite of phishers, so yours should be clearly from your verified domain, with SPF, DKIM and DMARC passing.
• A reset link is a key to the account: it must expire and must not leak.

Good practice

• Use a long, random, single-use token in the link, and make it expire (an hour or less is common).
• Say who asked and when, and what to do if it wasn't them. Don't include the old or a new password.
• Send from your own verified domain with SPF, DKIM and DMARC in place.
• Don't put tracking on reset links: the link should go straight to your site.
• Use an idempotency key so a double click doesn't send two emails.
• After the password changes, send a short confirmation, so the owner notices if it wasn't them.

Send it with Vaartix

await vaartix.emails.send(
  {
    from: 'Acme <[email protected]>',
    to: user.email,
    subject: 'Reset your Acme password',
    html: `<p>Someone asked to reset the password for ${user.email}.</p>
           <p><a href="https://acme.in/reset?token=${token}">Choose a new password</a>
           (the link works once, for 1 hour).</p>
           <p>If it wasn't you, ignore this email: your password stays the same.</p>`,
  },
  { idempotencyKey: `reset-${resetRequestId}` },
);

Using Laravel, Django or another framework's built-in reset flow? Point its mailer at Vaartix with the Laravel, Django or Symfony guide, or over SMTP.