We are seeing a hosted email OTP delivery failure and would appreciate a delivery-log review.
Setup:
- React + Vite web application
@web3auth/auth11.8.2sapphire_mainnet- Hosted/default Email Passwordless OTP using the code flow
- Redirect UX
- The exact non-wildcard HTTPS origin is allowlisted
- Google login works on the same Web3Auth project
Observed behavior:
- The hosted
/v8/authorizepage opens and says that a 6-digit verification code was sent. - The passwordless start request returns success with a tracking ID.
- No OTP email arrives in Inbox, Spam, or Trash after five minutes.
- We reproduced this with both a primary address on a custom domain and a plus alias on the same domain.
- The primary address successfully received messages from
no-reply@web3auth.ioas recently as July 16, so this mailbox and route previously worked. - We submitted the official resubscribe form successfully, waited, and retested. Delivery still did not occur.
- An HTTP 427 response appeared only after repeated QA attempts. After a cooldown, the start request succeeded again, but accepted attempts still produced no email.
- There are no Siftr application errors during the accepted attempts, and the Web3Auth status page reports the mail services as operational.
Could support please inspect the SendGrid/mail delivery events for suppression, bounce, domain blocking, quota, or rate limiting? We can provide the affected addresses, exact UTC attempt windows, client/project details, and network evidence privately to a MetaMask support representative.