The form always says a link has been sent, whether or not one was, so that it cannot be used to find out who has an account. So first, find out whether the platform sent one at all:

  1. The address has no login. A reset goes to the person with that email address only if the person has a user. A guest who bought something, a form submitter or an imported customer is a person without one, and gets nothing. Registering does not help them either, because registration refuses an address that already belongs to a person ("This email is already used."). An administrator has to add the login (guest and account checkout).
  2. The login is not active. Inactive and disabled users get nothing.
  3. Password sign-in is switched off for the site. In 2026.5.2 the forgotten-password page then redirects away, and nothing can be requested.
  4. It was sent somewhere else. On any environment other than production, the platform sends mail to the development address unless the recipient matches its whitelist.
  5. It was sent and filtered as spam. The default sender is no-reply@coredna.com, named "Core dna DXP", with the subject "Core dna: Password Reset". In the Users settings, set the sender to an address on the client's own domain, authenticated with SPF and DKIM, and change the subject.

One related case is not silent: a Twig site needs templates/users/emails/reset-password-twig.html deployed, or a reset request for a real, active address answers a server error instead of the usual message. A member who signs in only with Google or Microsoft does get the email, and setting the new password also switches password sign-in on for their account, so they can use either afterwards (forgotten and reset passwords).