A verification email that has not arrived almost always has one of ten explanations, and they are not equally likely. In rough order: it is in your mailbox but not the inbox, the address you typed is not the address you own, the account already exists so the site sent something else, the mail is still in a retry queue, the code arrived and expired, a filter or forwarding rule moved it, you are on the sender's suppression list, the sender's authentication is failing, or the site quietly refuses the kind of address you used. Checking in that order takes five minutes and avoids the one thing that makes the problem worse.
That thing is the resend button. On most systems a new code invalidates every earlier one, so pressing resend four times while the first email is still in transit leaves you with four messages of which only the last works — and typing the code from the first one that lands then fails, which looks exactly like the site being broken. Many senders also rate-limit resends per address per hour. Press it once, then stop and read on.
The first three checks: ninety seconds
1. Search the whole mailbox, not just the inbox
Scanning the inbox and concluding nothing arrived is the most common mistake, because the message may never have been shown there. Search instead of looking, across all folders: the sender's domain, then verify, confirm and code separately. On Gmail, check the Promotions and Updates tabs and search with in:anywhere, which covers Spam and Trash — ordinary searches do not. On Outlook, check Junk Email and the Other tab of Focused Inbox. On Apple Mail, check Junk on the server account, not on the device.
If you find it in spam, do not just open it — mark it as not spam, which teaches the filter. Otherwise the next code from that sender lands in the same place.
2. Re-read the address you actually submitted
Domain typos are the ones that survive scrutiny, because the local part looks right: gmial.com, outlok.com, yaho.com. Mail to those either bounces somewhere you never see or lands with a domain squatter. Three more to rule out: a browser autofill that quietly used an old address you no longer read, a trailing space pasted in from elsewhere, and an alias you forgot. If you signed up with a plus address such as you+shop@example.com, the mail arrives at you@example.com — but a filter you built around that alias may have already filed it out of sight.
3. Check whether the account already exists
Sites deliberately avoid telling you an address is already registered, because that would let anyone test whether you have an account. So signing up again with an existing address often sends a password reset, or a "someone tried to register with your address" notice, instead of a verification link — and you are waiting for an email that was never going to be sent. Try the login and password reset flows before assuming delivery failed.
When it is probably still on its way
4. Greylisting and ordinary queue delay
Mail delivery is allowed to be slow. If the receiving server does not recognise the sender, it can reply with a temporary failure — a 4xx code — telling the sender to try again later rather than to give up. This is greylisting, and it exists because much spam software never retries. Legitimate senders do, but the gap is typically several minutes and can be fifteen or more, so the message only reaches you on the second attempt.
Large senders are usually exempt in practice because receiving servers already know them; a small site running its own mail server is exactly where greylisting bites. Give it a genuine ten to fifteen minutes before deciding the mail is lost. If it does arrive late, the Received headers carry a timestamp at every hop, and reading those headers in order shows whether the delay was at the sender, in the middle, or in your own provider's filtering.
5. The code may have arrived and already expired
Verification codes are short-lived by design, often five to fifteen minutes, and reset links rarely last beyond an hour. If you requested a code, got distracted, and came back to an email the site now rejects, the clock is the problem, not the delivery. Request one more and use it immediately — the newest code is the only live one.
One habit is worth building while you are here: codes matter precisely because they are the last step before account access, and the common ways they get intercepted rely on you treating a code as routine. A code you did not request is not a delivery glitch — it is a sign someone else is trying the first half of this process with your address.
Checks inside your own mailbox
6. Filters, rules and forwarding you set up and forgot
A rule written years ago to tidy up newsletters can match a verification email by accident — anything filtering on "offer", "account" or a sender domain you once muted. Open your provider's filter list and read it rather than trying to remember it. Two things matter: rules that archive or delete without marking as read, which produce silent disappearance, and any forwarding rule or recovery address you do not recognise. An unexplained forwarding rule is the most serious thing on this page — remove it, then change your password.
7. A full or dormant mailbox
Mailboxes at quota reject new mail outright, and some free providers deactivate accounts left unopened for months. Both produce a hard bounce the sender sees and you do not. If you are waiting at an address you rarely use, log in and confirm it still accepts anything by sending yourself a test message from another account.
8. You are on the sender's suppression list
This is the invisible one. If mail to your address bounced repeatedly before, or you once clicked "report spam" on something from that sender, their email platform may have added you to a suppression list and now refuses to send to you at all — no bounce, no error, nothing visible at either end. Marking an old message "not spam" does not undo it. The only fixes are asking the site's support to clear the suppression, or registering a different address.
Checks on the sender's side
9. The sender's authentication is failing
Receiving providers check that a message really comes from the domain it claims, using three records the sending domain publishes. When a site has just changed email providers, or sends through a third party it never authorised properly, those checks fail and the mail is filed as spam or rejected silently. You cannot fix someone else's DNS, but you can recognise the pattern — nothing from this one sender ever arrives while everyone else's mail is fine — and a read of what SPF, DKIM and DMARC verify tells you what to put in the support ticket.
10. The site refuses the kind of address you used
Some signup forms accept an address, show a success message, then never send anything, because the address failed a check behind the scenes. Three categories trigger it: disposable domains on a blocklist, role addresses such as admin@ or info@ that many platforms reject as shared mailboxes, and newer top-level domains some validators still treat as invalid. The form rarely says which. If you used any of the three, try a mainstream address once as a diagnostic.
If nothing has arrived after twenty minutes
Escalate in this order. First, request one code at a different address on a different provider — that separates a sender problem from a mailbox problem in a single step. Second, look for an alternative route: many services verify by SMS, through an existing social login, or via an in-app prompt, and any of those gets you in today. Third, contact support with details they can look up: the address, the exact time you requested the code, and your time zone. "I did not get the email" earns a reply telling you to check your spam folder. "I requested a code at 14:12 UTC today for this address, and your logs should show whether it was sent, bounced or suppressed" gets it read by someone who can act.
Reducing the odds next time
Two habits remove most repeat occurrences. Keep the address you use for real accounts out of newsletter and competition forms, so a verification email never competes with a hundred marketing messages for the same folder. And when a site wants an address only as a turnstile — a gated download, a one-off code, a forum you will read once — send it somewhere disposable, where the only message in the inbox is the one you are waiting for and the inbox refreshes while you watch it.
A missing verification email is rarely a mystery. It is a short list of ordinary failures, and the order in which you check them decides whether this takes five minutes or an afternoon.