Short answer
Check four things: that the address has an account in Firebase Authentication (with email enumeration protection on, Firebase sends nothing for an unknown address and shows no error), the spam folder, your project’s daily limit for password reset emails, and the sender domain. Sending from your own verified domain, set in the Authentication Templates tab, puts your brand in the From field and lets you add the DNS records that show the email is yours.
Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.
Why the email doesn’t arrive, and the fix
01
There is no account for that address
“When you make a password reset request, a verification email is sent only if the email address exists” Google Cloud, Enable or disable email enumeration protection
Projects created on or after September 15, 2023 have email enumeration protection on by default. With it on, Firebase sends nothing for an address that has no account and returns no error, so your app shows success either way. Look the address up in the Users tab of Firebase Authentication; the user may have signed up with another email.
02
It landed in spam
“Set up SPF or DKIM email authentication for your sending domains.” Google, Email sender guidelines
Ask the user to check spam and promotions. Until you apply a custom domain, the email comes from Firebase’s default domain rather than your own, and inboxes trust mail more when the sending domain is authenticated.
03
Your project hit the daily limit
Firebase lists a daily limit for password reset emails: 150 a day on the no-cost Spark plan and 10,000 a day on the Blaze plan, and says these quotas scale with the number of users. A launch day or a bulk reset can use up the Spark limit for the day.
04
The custom sender domain was never verified or applied
“It can take up to 24 hours for the domain to be verified.” Firebase, Use a custom domain for Authentication emails
In the Firebase console, open Authentication, then Templates, edit each template and choose customize domain. Add the TXT and CNAME records Firebase shows at your domain registrar. A domain can have only one v=spf1 TXT record, so merge it with any you already have. When the green Verification complete message appears, click Apply Custom Domain.
Checked against the vendor’s docs on : Google Cloud docs: Email enumeration protection; Firebase docs: Use a custom domain for Authentication emails; Firebase Help: Customize account management emails; Firebase docs: Authentication limits; Google: Email sender guidelines.
Rather hand it over?
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
- from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start
“Very responsive, attentive to fixing bugs, and completed the project as needed! Thank you!”
Related: Supabase emails going to spam · Firebase auth/invalid-action-code · Firebase auth/too-many-requests · Firebase auth/unauthorized-continue-uri