How do I use this when a code has not arrived?

Search for the sender, not the word “code”. In Gmail, a search such as in:anywhere from:steampowered.com newer_than:1d finds recent mail from Steam in every folder, Spam and Trash included. If it finds nothing, the email has not reached that mailbox, and the problem is the address or the delivery, not your search. The not-arriving checklist covers what to do next.

Use the stated window to decide whether to wait or resend. If a service says codes last 10 minutes and yours is 15 minutes old, request a new one. If the service publishes no window, do not assume one: use only the newest code, and request a fresh one from the open login page if it is refused. The stale-code check explains why.

Check the sender before you type the code. A code email from an address that is not on the list the service publishes, or a lookalike of one, is a reason to stop. See how to spot a fake verification email.

What do the services actually publish?

Less than you would expect. Of the 17 services, 11 name the address their emails come from, 14 list causes for a missing code, and only 4 state how long a code lasts: PlayStation, 10 minutes after the sign-in attempt; Bank of America (Business Advantage 360), 10 minutes, single use; American Express, 10 minutes after it is generated; DoorDash, 30 minutes. Two of those are not email sign-in codes: PlayStation’s comes by text or app, and American Express’s is a checkout code. So for most services, “how long does the code last?” has no published answer, and a page that gives one without naming its source is guessing.

The causes the services do list are mostly on the receiving side: spam and junk folders, inbox filters, a mistyped address, a full inbox, or a company mail server blocking the sender. That is why searching Spam and checking the address on the account come before resending. Microsoft is the exception that also names its own side: it may not send a code after unusual activity or too many requests.

7 of the 17 document another way to verify, such as an authenticator app or a text message. If you rely on one of them, setting that up now means a missing email is an inconvenience rather than a lockout. See what to set up before switching to an authenticator app.

On a phone, scroll each table sideways to see all columns.

Email, cloud and collaboration

Service	Sender to search for	Stated validity	Causes the service lists	Other ways to verify
Apple Account The sender name is "Apple". If your provider filters mail, Apple suggests allowing messages from email.apple.com.	`email.apple.com`	Not published	the email is in Spam, Junk, Trash, Deleted Items or Archive; you are checking the wrong account; the address is misspelled; your email provider blocks it	None listed
Google Account Page covers verifying an email address on a Google Account, by code or link. If the link has expired, Google says to request a new one.	`account-verification-noreply@google.com`	Not published	the email is in spam or bulk mail; the address was entered incorrectly	None listed
Microsoft account Microsoft says it is phasing out SMS codes for personal accounts. It is the only service here that lists reasons on its own side for not sending a code.	`@accountprotection.microsoft.com`	Not published	the code went to junk; the email address is wrong; Microsoft blocked sending after unusual activity; too many repeated requests; heavy compromised traffic from your region	Microsoft Authenticator, Windows Hello, security key
Slack	`@slack.com`, `@slack-mail.com`	Not published	spam, junk or an inbox filter; your email system flags Slack emails; the address on file is wrong	None listed
Spotify Page covers the email-verification message. If you no longer use the address, edit it before resending; Spotify also suggests restarting the app.	Not published	Not published	spam, junk or another filtered folder; an inbox filter blocking mail from Spotify	None listed

Service	Sender to search for	Stated validity	Causes the service lists	Other ways to verify
Facebook Meta says its mail comes only from these domains (and instagram.com), including subdomains. facebook.com/recent_emails/security lists the security emails it actually sent you, so you can check a suspicious one.	`facebook.com`, `facebookmail.com`, `fb.com`, `meta.com`, `metamail.com`	Not published	None listed	None listed
Instagram Page covers the password-reset email. Instagram says that if the address was mistyped at signup, it cannot give you access to that account.	`@instagram.com`	Not published	the email went to spam; the address was mistyped at signup	reset through Facebook if the accounts are linked
LinkedIn If the email bounced, add another valid address. If your only address has bounced, LinkedIn asks you to verify your identity to regain access.	Not published	Not published	the email is in spam or junk; the email bounced	None listed

Gaming

Service	Sender to search for	Stated validity	Causes the service lists	Other ways to verify
PlayStation PlayStation's 2-step verification code comes by text or authenticator app, not email.	Not published	10 minutes after the sign-in attempt	phone signal or airplane mode; delivery can take a few minutes	SMS, authenticator app, passkey
Steam Valve says delivery delays from some email providers can reach 30 minutes, so a late Steam Guard email is not necessarily lost.	`support@steampowered.com`, `noreply@steampowered.com`	Not published	the wrong email address; a spam filter; email provider delays	None listed

Payments and investing

Service	Sender to search for	Stated validity	Causes the service lists	Other ways to verify
PayPal Page covers the email-confirmation message, which you can resend from PayPal Settings. If it looks garbled, PayPal suggests switching your email to plain text.	`service@paypal.com`	Not published	the email went to spam; the address was mistyped at signup	None listed
Stripe For a work address, Stripe suggests asking your IT team to allow @stripe.com.	`@stripe.com`	Not published	a wrong address on file; spam, junk or a filter; a corporate mail service blocking Stripe; a full inbox	None listed
Venmo Venmo texts its codes from the short code 86753 and verifies email by link. Search your inbox for "Venmo".	Not published	Not published	the email is in spam or junk; short-code texts are blocked by your carrier	SMS code

Banks and cards

Service	Sender to search for	Stated validity	Causes the service lists	Other ways to verify
American Express This is the SafeKey code at online checkout, not account login. You can resend within the 10 minutes; after that you have to start the purchase again.	Not published	10 minutes after it is generated	the email is in spam; SMS cannot reach some countries	text message
Bank of America (Business Advantage 360) This is Business Advantage 360 online banking, which sends a one-time code by text or email at each sign-in. The page does not cover personal online banking.	Not published	10 minutes, single use	None listed	text message

Travel and delivery

Service	Sender to search for	Stated validity	Causes the service lists	Other ways to verify
Airbnb Airbnb's page lists more legitimate domains than shown here, and says Airbnb will never call to ask you to share a one-time code.	`@airbnb.com`, `@support-email.airbnb.com`, `@supportmessaging.airbnb.com`, `@airbnb.zendesk.com`	Not published	None listed	None listed
DoorDash The 6-digit code comes by email or text, and you can have it resent to the other one. DoorDash suggests allowing up to 2 minutes before resending.	`@doordash.com`	30 minutes	the email is in spam or junk; the phone cannot receive SMS; a Wi-Fi or network problem; you unsubscribed from DoorDash texts	text message

How was this checked?

Each row was read from the service’s own help or security page, linked from its name, on 2026-09-26. We do not copy facts from one service to another or from third-party summaries. Help pages change, so the linked page is the authority, and each row is due for review by 2026-12-26. If you find a row that is out of date, write to the address in the footer.