Does SimpleLogin in front of Fastmail swallow password-reset messages?
Greg Foster
October 7, 2026
Sometimes. A password reset sent to a live SimpleLogin alias usually shows up in Fastmail. It gets swallowed when the alias is disabled, when the site refuses to mail an alias domain, when SimpleLogin blocks the message, or when Fastmail files the forwarded copy as spam. The reset link in the body is still a link. SimpleLogin is not rewriting it into garbage. The usual failure is that you are looking in the inbox for a message that landed in spam, or that never left the other company’s server.
I put SimpleLogin in front of Fastmail so sites never see the real address. That works until the day I am locked out and the reset is the only mail that matters. The alias did not “break email.” It added two more places a single message can die.
When does the reset actually arrive?
You signed up with the alias. The alias is still enabled. SimpleLogin is forwarding to the Fastmail address you think it is. The site accepts the alias domain and sends a normal message. Fastmail does not junk it. In that path I get resets from banks, Git hosts, and random SaaS all the time. The subject looks like a reset. The From is the site, sometimes with a via line because it was forwarded. The link works if I open it soon, same as any reset.
If that is your setup and a reset is missing, check Fastmail spam and the SimpleLogin activity log before you create a new alias and make the problem worse. The log tells you whether SimpleLogin saw the message. Spam tells you whether Fastmail hid it. Those two screens answer the question faster than a forum thread.
Which cases look like swallowing?
The alias is off. You disabled it because that site spammed you, then you needed a reset from the same site. SimpleLogin will not forward to a disabled alias. The site may say the mail was sent. Your Fastmail inbox is honestly empty. Enable the alias, request the reset again, and disable it after you are in. Do not leave a disabled alias as the address of record for an account you still have to recover.
The site will not send to the alias domain. Some banks and government logins reject simplelogin.com addresses, or a custom domain they have decided is a forwarder, at signup or at reset time. The error is on their form, or the message never appears in SimpleLogin’s log because they never sent it. That is not Fastmail. Use a real Fastmail alias on your own domain for those few accounts, and keep SimpleLogin for the sites that tolerate it. One real address for the five places that hate forwarders is the whole fix.
SimpleLogin blocked it. Forwards that look like bulk, phishing, or a burst can be held. A reset is automated mail from a noreply address with a link, which is exactly what abuse filters are jumpy about. The activity log is again the source of truth. If it shows blocked, the inbox was never going to help. Unblock or whitelist that sender, then request a new reset. The old link may already be dead.
Fastmail junked the forward. Forwarded mail has extra headers. A sieve rule you wrote for newsletters, or Fastmail’s own spam weighting, can file a reset next to a sale. Search the whole mailbox for the site’s name, not just the inbox. Then add a contact or a rule that keeps that sender in the inbox. Do this for the accounts you would hate to lose, not for every shop.
What the link is, and is not, doing
The link in a reset is usually a normal HTTPS URL to the site. SimpleLogin forwards the body. It does not need to wrap that URL for the forward to work. If you click and the site says the link expired, you waited, or you clicked an older mail, or a scanner prefetch burned a one-time link. Some security gateways prefetch links. A forward path with an extra hop makes that slightly more likely, not certain. If one reset link dies instantly, request another and open it from the Fastmail web view before anything else touches it.
Reply-from-alias is a different feature. You do not reply to a reset. You click it. People confuse a broken reply alias with a swallowed reset. If you can see the message, it was not swallowed. If the link fails, that is the site’s token, not the absence of the mail.
The address the site thinks is you
Sites store the address you typed at signup, and sometimes a second address they found later. A reset goes to the one in the profile, not to the one you wish you had used. If you changed the account email to the real Fastmail address, the reset bypasses SimpleLogin and you will not see it in the alias log. If you changed it to a new alias and the site still has the old one, the reset goes to the old alias. Open the account’s email field while you are still logged in, before you are locked out. The field is the routing. Your memory is not.
Custom domains on SimpleLogin that then forward to Fastmail add DNS as a failure. If MX for the alias domain is wrong, the site’s mail never reaches SimpleLogin, the log stays empty, and Fastmail is innocent. The domain you use for aliases has to actually receive mail at SimpleLogin. Test with a manual send from another account to that alias. If your own test does not arrive, a reset will not either.
Why Fastmail rules make this worse than SimpleLogin does
A sieve rule that files anything with “unsubscribe” or “noreply” into a folder called Later will catch resets, because resets come from noreply and sometimes include a footer. I have done this to myself. The message was forwarded perfectly. My own rule hid it under a name I do not check while I am locked out. Open Later, Newsletters, and Spam. Then narrow the rule so a sender you depend on for account recovery is excluded. SimpleLogin did not swallow it. You wrote a rule that did.
Fastmail’s spam learning also remembers. If you once marked a forwarded alias message as spam because the shop was noisy, later mail from that alias, including a reset, inherits the suspicion. Pull the reset out of spam and mark it not spam. Do that before you request a second one, or the second one follows the first.
Two-factor mail is the same pipe. A code email is not a reset, and it dies in the same folders. If your bank emails a code to the alias, treat that sender as recovery mail. Pins and resets should not share a rule with catalogs.
Who should not put SimpleLogin on the recovery address
Do not put it on the one address a bank, a domain registrar, or your Fastmail account itself uses for recovery. Those resets are how you get the rest back. An alias in front of them adds a company and a toggle to the worst day. Use a real address on the domain Fastmail hosts, one you do not disable, one that is not behind a forwarder you might turn off during a cleanup. SimpleLogin is for the sites you can afford to lose or to recreate. It is a bad gate on the mailbox that receives the keys.
If you already did it, leave that alias enabled forever, or change the recovery address while you are logged in. Changing it while locked out is the scenario this article is about, and it is the one where the forwarder is in the way. Do the boring swap on a calm afternoon.
What to do the day you are locked out
- In SimpleLogin, confirm the alias is enabled and note which Fastmail address it forwards to.
- Request one reset. Do not request five. Some sites lock the account harder, and some filters treat the burst as abuse.
- Look at the SimpleLogin log. No row means the site did not send to that alias. A blocked row means SimpleLogin stopped it. A forwarded row means look in Fastmail, including spam and any folder a rule might use.
- Open the newest message and use the link once, promptly, from a browser you trust.
- If this site will never mail an alias, put a real Fastmail address on the account while you still can, and stop using SimpleLogin for that one login.
SimpleLogin in front of Fastmail does not automatically swallow password resets. It swallows them when the alias is off, the site never sent, SimpleLogin blocked the forward, or Fastmail hid it. The log and the spam folder are the diagnosis. A new alias is how you lose the account you were trying to save. Fix the route you already have before you invent a second address the site has never stored and will not use.
