Best practices for new member verification.

Steve Bowman

Steve Bowman

Member
Licensed customer
I'm taking over a Forum that has been online for decades, and on XF for ten years. I'm reading the manual, and learning the ACP. But I need help. I have full admin powers. XF Ver 2.3.13. Located in USA.

It appears the member verification process is broken. I ask friends to try joining, as a test, and they report back that they never get the verification email. Where do I start troubleshooting this problem? The forum email is a gmail account. Is that the problem? Settings in the backend?

If I can't get this working soon, I want to remove the verification altogether, temporarily, while I figure this out. How do I do that?

Would an ad-in/extension solve the problem without too much extra hassle?

Any advice or suggestions will be appreciated.

Steve
 
Email can be hard to figure out. I was using my domain's email server on a VPS and had tons of issues. I switched to using an external SMTP email service (SendGrid at first) to help get deliverability. Then early this year, they ended their free tier and my email deliverability was once again very poor. I migrated my forums to Xenforo and at the same time configured it to use Brevo (app.brevo.com) as an external mail sender. They allow up to 300 emails per day for free, which fits my forum well. It has solved my problems.

It is a little complex to set up. You need to be able to "zone records" to your domain's DNS. This is usually done where you buy the domain name, but can be elsewhere, like on your own VPS, or at your webhost, so figuring all that out is more difficult than the actual set up.

In the commercial email space, that you are now in, there are two basic types of non-spam email: marketing messages sent to someone who has opted in, and what they call "transactional" email. Transactional emails are those that the recipient initiates, like a verification email for registration. Unless you are going to periodically email your forum's members, all of the email from XF fall into the "transactional" email category. They register and need to confirm it, they request a notification when a post is updated, they want a password reset email. The reason I mention this is that some email services will gladly host your transactional email but be less enthused about marketing email (they might consider "summary emails" you send if a user is inactive as marketing emails - that option is found in Options > Email Options.

  • See if you have any entries in the bounced email log found in the forum admin section under Logs > Email bounce log.
  • Look at your email configuration in the admin section under Options > Email Options
  • You can test any changes you make by visiting Tools > Test outbound email
See if that gets to where you can narrow it down.
 
fshagan, Thank you for your detailed reponse. I'm looking at Brevo fand Zoho/Zepto, though I'm still a little confused. Claude is helping me. But at some point I might need to hire somebody to help me execute all this.
 
Maybe we can help you narrow it down a bit.

How is the forum hosted? Is it on it's own VPS, or on shared hosting?

Do you "own" the domain name too, and do you have access to it's "DNS settings" (usually set through where you buy your domain name from).
 
I'm being messaged and asked to provide more info on my Forum by some people offering to help.

It's reincarnationforum.com. It's called Carol Bowmans Reincarnation Forum because Carol, my wife, has written two books on the subject and is well known in the reincarnation world. She's being featured on a popular podcast, The Telepathy Tapes, starting this week, which is the urgency for getting it working again. It's gradually lost traffic and the mods slipped away. I discovered, just today, that a big reason is that no new members could sign up because of the email being blocked. Ouch!

It's hosted with Matt Worthington, who I found here. I own everything, including the domain name, and I have full access to the DNS records. We started the Forum in 1997 as a BBS. Then is was vBulletin, which was fine until it wasn't. I switched over to XF in 2016. For the last 15 years I've been an absentee owner, so to speak. Other people ran it, admins and mods, and it thrived. It' the oldest and largest forum on reincarnation on the internet. So even though I'm the owner (and pay all the fees), I've been uninvolved and, frankly, ignorant of how everything works, especially in the ACP. I'm fixing that now, and on a crash course to learn the ACP, read the manual, and now, to fix the verification and email problems. After I get through this email crisis, I intend to keep going, to add features, to connect to social media and do promotion (we never promoted it before), to start collecting donations, and to build up the library of resources, and make it better than ever.

I'm open to hiring help. I think I can fix the email problem on my own (with help from Claude.ai) enough to open it up to new members . Then I can take my time to find the right person to help with the advanced features. I'm learning, too, that the XF community is a valuable resource that I can depend on for ongoing support. Thank you for that.

Steve
 
It looks like you are self hosted on either a VPS or a dedicated server, and if you have access to the DNS records for the domain, you should be able to set up an external SMTP (email sending service) like Brevo. It's pretty easy to set up, but not the most economical choice if you have more than 300 emails a day. For larger senders, Amazon's SES (Simple Email Services) is a good choice, but the set up is complex and dealing with Amazon is a pain.

With what's at stake, hiring someone might be a good idea. I worked with @MySiteGuy to transfer my forums to XF and fix some database problems; I can recommend him. That's not to say others aren't good, I just haven't used anyone else.
 
Had a peek at what you have going on. Gmail is flat-out rejecting emails sent to its email service with a gmail email address that doesn't align to its IP space. This is working by design to stop spam and fake email addresses masquerading as gmail. And... email providers with exceptionally strict DKIM and SPF checks will outright bounce-back, blackhole, or reject the email. In your case, this is what is transpiring.

I can receive emails from your forum with my personal email server. Your XenForo configuration is enveloping your gmail address to send with - this is bad practice to do.

Code: 
Delivered-To: <brett@REDACTEDDOMAIN.net>
Return-Path: <SRS1=tsW6=mail.REDACTEDDOMAIN.net==pPAO=IA=gmail.com=childrensplforum@mail.REDACTEDDOMAIN.net>
Received: from mail.REDACTEDDOMAIN.net ([10.250.0.6])
    by mail.REDACTEDDOMAIN.net with LMTP
    id sTBTHHivyWp2aQEAvnk1+g:P1
    (envelope-from <SRS1=tsW6=mail.REDACTEDDOMAIN.net==pPAO=IA=gmail.com=childrensplforum@mail.REDACTEDDOMAIN.net>)
    for <brett@REDACTEDDOMAIN.net>; Sat, 10 Oct 2026 03:22:32 +0000
Received: from mail.REDACTEDDOMAIN.net ([10.250.0.6])
    by mail.REDACTEDDOMAIN.net with LMTP
    id sTBTHHivyWp2aQEAvnk1+g
    (envelope-from <SRS1=tsW6=mail.REDACTEDDOMAIN.net==pPAO=IA=gmail.com=childrensplforum@mail.REDACTEDDOMAIN.net>)
    for <brett@REDACTEDDOMAIN.net>; Sat, 10 Oct 2026 03:22:32 +0000
Received: from cp2.mattwservices.uk (cp2.mattwservices.uk [209.222.101.79])
    by mail.REDACTEDDOMAIN.net (Postfix) with ESMTP id DE0F84702DA
    for <brett@REDACTEDDOMAIN.net>; Sat, 10 Oct 2026 03:22:31 +0000 (UTC)
Authentication-Results: mail.REDACTEDDOMAIN.net;
    dkim=none;
    spf=softfail (mail.REDACTEDDOMAIN.net: 209.222.101.79 is neither permitted nor denied by domain of childrensplforum@gmail.com) smtp.mailfrom=childrensplforum@gmail.com;
    dmarc=fail reason="No valid SPF, No valid DKIM" header.from=gmail.com (policy=none)
Received: from reincarn by cp2.mattwservices.uk with local (Exim 4.100.1)
    (envelope-from <childrensplforum@gmail.com>)
    id 1xFNfL-0000000FYqV-03wV
    for brett@REDACTEDDOMAIN.net;
    Sat, 10 Oct 2026 03:22:31 +0000
From: Reincarnation Forum <childrensplforum@gmail.com>
To: BrettC <brett@REDACTEDDOMAIN.net>
X-To-Validate: b4a0e2bb+brett@REDACTEDDOMAIN.net
Subject: Reincarnation Forum - Account confirmation required
Auto-Submitted: auto-generated
Message-ID: <c1a1ce6492ec8e29ae15ea1af62d8f0e@gmail.com>
MIME-Version: 1.0
Date: Sat, 10 Oct 2026 03:22:30 +0000
Content-Type: multipart/alternative; boundary=vb0sdbeL
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - cp2.mattwservices.uk
X-AntiAbuse: Original Domain - REDACTEDDOMAIN.net
X-AntiAbuse: Originator/Caller UID/GID - [1035 977] / [47 12]
X-AntiAbuse: Sender Address Domain - gmail.com
X-Get-Message-Sender-Via: cp2.mattwservices.uk: authenticated_id: reincarn/only user confirmed/virtual account not confirmed
X-Authenticated-Sender: cp2.mattwservices.uk: reincarn
X-Source: 
X-Source-Args: 
X-Source-Dir: reincarnationforum.com:/public_html
X-Spamd-Bar: ++
X-Spam-Level: **

Here is what you need to do, and you have two options on this front:

1. Setup a mail server on your actual server (and deal with the headache of email daemons in general), or...
2. Use a third party email service with proper domain alignment, SPF, SKIM, among other features.

I would go with option two. Which means the following has to be done:

1. Choose a Transactional email service. That could be Postmark, Mailgun, SendGrid (part of Twilio), AWS's SES, or SendinBlue (Brevo). There are others, but it doesn't come to mind.
2. Once a platform is chosen, said platform should give you steps to setting up MX, SPF, DKIM, and A records accordingly on the DNS level.
3. Update XenForo's email settings at /admin.php?options/groups/emailOptions/
4. Test the outbound mail settings.
 
I would recommend against Amazon's SES. It worked great for me...until it didn't. And the interface was such a clusterfudge that I couldn't navigate my way to fix whatever it was they were complaining about. If it were easier to navigate through, I'd go back to it. There is absolutely no reason AWS needed to make their cloud offerings so convoluted.

I went with ZeptoMail (or whatever it's called now) temporarily on a smaller forum and have had zero issues, but it does not handle automated bounce handling. Its paid tier is so inexpensive on this smaller forum that I only pay a couple of dollars and get half a year of service well within my sending limits.

I have DNS set up at Cloudflare, so setting all the domain records for email is my responsibility. That can also be confusing, and online documentation often contradicts itself. Essentially though, you are putting settings in your domain records that attempt to identify that the email is coming from your server, and not a spammer's server.
 
I went with my host server's cPanel email options.
The funny thing is some others that are meant to work don't work well or you need to pay extra for storage.
How do i know this?
Have a gmail account and get asked to pay $2.99 a month for storage.
 
Wildcat Media said:
I would recommend against Amazon's SES. It worked great for me...until it didn't. And the interface was such a clusterfudge that I couldn't navigate my way to fix whatever it was they were complaining about. If it were easier to navigate through, I'd go back to it. There is absolutely no reason AWS needed to make their cloud offerings so convoluted.

I went with ZeptoMail (or whatever it's called now) temporarily on a smaller forum and have had zero issues, but it does not handle automated bounce handling. Its paid tier is so inexpensive on this smaller forum that I only pay a couple of dollars and get half a year of service well within my sending limits.

I have DNS set up at Cloudflare, so setting all the domain records for email is my responsibility. That can also be confusing, and online documentation often contradicts itself. Essentially though, you are putting settings in your domain records that attempt to identify that the email is coming from your server, and not a spammer's server.
Click to expand...
I also found SES complicated. And slow to implement. I gave up and went with the free tier at Brevo (formerly SendInBlue), which is great for my small forum. I like being able to look in the logs and see when someone opened, clicked, or acted on an email.
 
I run a couple forums, too. The oldest is also from 1997, like yours, and went through about 4 other platforms before landing on Xenforo. (Proboards, UBB, UBB Threads, Vbulletin 3, 4, etc)

We are using the email from our own domain, through the email server of the uplink provider. It has been mostly trouble free, and we send out 200-300 emails per day.

Some third party tools I love. (not a complete list)
  • Andy (XF2 Addons) has a LOT of very useful tools that we use for a flat price. (some of my favorites are: Access Log, approval queue email, approval queue location, ban thread, broken links, classified forums, classified location check, direct message manager, direct message phishing detect, email log, open graph thread, register email, RESOLVED post, SOLD post, EXPIRED post, search log, thread starter user banner, user upgrade expired msg, warn thread,
  • Siropu to monetize the forum with paid banners, and chat
  • OZZY47 (Snog) has some great tools
  • CLOUDFLARE is set up before the forum, and blocks a LOT of fake registrations and aggressive bots
  • XF Botguard is an amazing tool that works hand-in-hand with cloudflare, to keep the bots tamed.
  • Digitalpoint App for Cloudflare is excellent.
 
You must log in or register to reply here.
Back
Top Bottom