How do I keep password resets out of spam with an email API?

To keep password reset emails out of spam when using an email API, focus on authentication, reputation, content, and sending behavior.

1) Authenticate your domain properly

This is the biggest factor.

• SPF: authorize your email API provider to send on your behalf
• DKIM: sign messages so inbox providers can verify they weren’t altered
• DMARC: tell providers how to handle unauthenticated mail and improve trust

Also make sure:

• the From domain matches your authenticated domain
• your return-path/bounce domain is set up if your provider supports it
• you’re not sending from a random shared domain if a custom sending domain is available

2) Use a dedicated sending domain/subdomain

Send transactional mail from something like:

• mail.yourdomain.com
• notify.yourdomain.com

instead of your main marketing domain, if possible.

This helps isolate reputation so password resets aren’t affected by marketing campaigns.

3) Keep content simple and clearly transactional

Password reset emails should look like password reset emails.

Good practices:

• clear subject like: “Reset your password”
• plain, direct copy
• one primary call to action
• no promotional language
• avoid spammy phrases like “urgent”, “act now”, “free”, etc.
• include both a button and a plain link
• include your brand name and support contact

4) Avoid risky HTML and formatting

Spam filters can be triggered by messy templates.

Avoid:

• huge images
• image-only emails
• excessive colors/fonts
• broken HTML
• too many links
• URL shorteners

Best practice:

• mostly text with a single reset button
• plain-text version included
• clean, responsive HTML

5) Make the link trustworthy

Reset links should:

• use your own domain
• be HTTPS
• be short and clean
• expire quickly
• be single-use

Avoid sending links that redirect through multiple domains.

6) Send only when needed

Password resets are transactional, so they should be user-initiated.

Do not:

• send resets repeatedly without a new request
• send to users who didn’t ask for it
• batch or delay them unnecessarily

If users request resets often, add rate limiting and abuse protection.

7) Protect your sender reputation

Even transactional mail can get flagged if your reputation drops.

Watch for:

• hard bounces
• spam complaints
• invalid addresses
• poor deliverability from shared IP pools

If volume is high, consider:

• a dedicated IP
• warming it up gradually
• monitoring reputation metrics in your email API dashboard

8) Set up proper headers

For transactional mail, make sure your API supports:

• List-Unsubscribe is usually not needed for resets
• Auto-Submitted: auto-generated
• Precedence: bulk is usually not necessary
• consistent Message-ID
• correct Reply-To if replies are monitored

Some providers handle this automatically, but it’s worth checking.

9) Test deliverability

Use tools like:

• Gmail Postmaster Tools
• Microsoft SNDS
• inbox placement testing services
• seed tests to Gmail, Outlook, Yahoo, etc.

Check whether your reset email lands in:

• Inbox
• Promotions
• Spam

Then adjust authentication and content accordingly.

10) Make sure your API provider is configured for transactional sending

If your provider supports multiple streams or categories:

• put password resets in a transactional stream
• separate them from marketing mail
• ensure they use the correct domain and IP pool

---

Quick checklist

If you want the shortest path to better inbox placement:

• SPF, DKIM, and DMARC are set up
• Use a custom sending domain/subdomain
• Send from a transactional mail stream
• Use a simple, branded subject and body
• Include plain-text and HTML versions
• Use a clean HTTPS reset link on your domain
• Monitor bounces and complaints
• Don’t mix marketing and password resets

If you tell me which email API you’re using (SendGrid, Mailgun, SES, Postmark, etc.), I can give you a provider-specific setup checklist.