When to use this
New sign-ins, sign-ins from unrecognized devices, or sensitive account changes. The reader is in one of two states: "yes, that was me" (they should be able to dismiss in two seconds) or "no, it wasn't" (they need one obvious action, immediately). Design for both states and nothing else.
Design rules for security alerts
Give the facts in a scannable block: when, what device, roughly where. Approximate location is enough, precise geolocation reads as creepy and is often wrong anyway. One action button, clearly labeled, going to your real domain. No marketing, no cross-sells, nothing that makes a security email look like a campaign: the moment users can't tell your alerts from promotions, they stop reading alerts. And keep the "this was me" path effortless, which means the email needs no button for it at all.
The template
Copy-ready, table-based, inline styles only. Swap the {{placeholders}} for your values.
<!DOCTYPE html>
<html lang="en">
<body style="margin:0;padding:0;background:#f4f5f7;font-family:Arial,Helvetica,sans-serif;">
<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#f4f5f7;padding:24px 0;">
<tr><td align="center">
<table role="presentation" width="440" cellpadding="0" cellspacing="0"
style="background:#ffffff;border-radius:8px;padding:32px;">
<tr><td style="font-size:18px;font-weight:bold;color:#111;padding-bottom:8px;">
{{company_name}}
</td></tr>
<tr><td style="font-size:15px;font-weight:bold;color:#111;padding-bottom:12px;">
New sign-in to your account
</td></tr>
<tr><td style="font-size:14px;color:#444;line-height:1.6;padding-bottom:16px;">
We noticed a sign-in to your account. If this was you, no action is needed.
</td></tr>
<tr><td style="padding-bottom:20px;">
<table role="presentation" width="100%" cellpadding="0" cellspacing="0"
style="background:#f4f5f7;border-radius:6px;">
<tr><td style="padding:14px 18px;font-size:13px;color:#444;line-height:1.7;">
<strong>When:</strong> {{login_time}}<br>
<strong>Device:</strong> {{device}}<br>
<strong>Location:</strong> {{approx_location}}
</td></tr>
</table>
</td></tr>
<tr><td style="font-size:14px;color:#444;line-height:1.6;padding-bottom:20px;">
If this wasn't you, secure your account now:
</td></tr>
<tr><td align="center" style="padding-bottom:20px;">
<a href="{{secure_account_url}}"
style="display:inline-block;background:#111;color:#ffffff;text-decoration:none;
font-size:14px;font-weight:bold;padding:12px 28px;border-radius:6px;">
Secure my account
</a>
</td></tr>
<tr><td style="font-size:12px;color:#888;line-height:1.5;">
You're receiving this because security alerts are enabled for your account.
</td></tr>
</table>
<table role="presentation" width="440" cellpadding="0" cellspacing="0">
<tr><td style="font-size:11px;color:#999;padding:16px 8px;text-align:center;">
Sent by {{company_name}} · {{company_address}}
</td></tr>
</table>
</td></tr>
</table>
</body>
</html>Deliverability: alerts live or die on trust
Login alerts have a special problem: they look exactly like what phishers imitate. Two things keep yours on the right side of that line. First, airtight authentication, SPF, DKIM, and DMARC aligned, because an unauthenticated security alert is indistinguishable from an attack and gets filtered like one. Second, a protected sending stream: alerts belong on your transactional reputation, isolated from marketing, so they arrive within seconds even when a campaign is misbehaving. Speed is part of the security: an alert about a sign-in that arrives an hour late has already failed.
If your alerts are landing in spam, start with the free deliverability check, auth misalignment is the usual culprit for security mail specifically.
Related
- OTP verification template: the companion security email
- Password reset template: for when it wasn't them
- SPF/DKIM/DMARC Setup: the auth layer alerts depend on
- Transactional Email Service: the protected stream