You know the experience: you sign up, switch to your inbox, refresh twice, finally see the verification email... and discover the link has expired.

It's frustrating because the product is telling you to complete a task and then punishing you for not completing it quickly enough.

Email verification sits at the intersection of backend security, delivery delays, and interface design. You need all three parts to cooperate.

There are actually two clocks

If you use a short-lived mailbox during QA, you'll see this clearly:

Mailbox clock: how long the destination can receive and display messages.

Verification clock: how long your application's link or one-time code stays valid.

Those values are independent.

A message can still be visible after its verification token expires.…