PayPal IPN not received or IPN listener not working: troubleshooting checklist

PayPal's IPN flow has four steps. PayPal POSTs the message to your listener. Your listener returns an empty HTTP 200. Your listener POSTs the complete message back, prefixed with cmd=_notify-validate. PayPal replies with one word, VERIFIED or INVALID. Most "IPN not working" problems break one of these steps.

1. Start with IPN History

In your PayPal account, open IPN History. It shows each message, the URL it was sent to, its status and your server's HTTP response code. Sent means your listener answered with 200. Failed or Retrying means it didn't. You can also resend messages from this page. By default a resend goes to the message's original URL, so tick the option to send it to your current profile URL if you've changed it.

2. Nothing arrives, or the status is Failed/Retrying

• Wrong or missing URL. The notify_url in your button or API call overrides the profile setting, so check both for typos.
• Redirects. PayPal's help center warns that a redirect, for example domain.com to www.domain.com in .htaccess, drops the POST data. Point the IPN at the final URL.
• Server errors or blocks. A 404, 500 or 503, an SSL handshake problem, a firewall, or basic auth on the listener all count as no acknowledgement.
• Not responding at all. If PayPal gets no 200, it keeps re-sending at growing intervals. PayPal's docs say it re-sends for up to four days, with a maximum of 15 retries.

3. You get INVALID

• Sandbox vs live mismatch. Sandbox IPNs must be posted back to https://ipnpb.sandbox.paypal.com/cgi-bin/webscr. Live IPNs go to https://ipnpb.paypal.com/cgi-bin/webscr.
• Message altered. Post back exactly the same fields and values, in the same order, with the same character encoding as the charset field. Rebuild the body from the raw POST, not from a re-ordered or decoded dictionary. In PHP, PayPal suggests rawurlencode and rawurldecode.
• No User-Agent. PayPal asks you to send a User-Agent header that describes your listener.

Minimal listener (Node, Express)

app.post('/ipn', express.raw({ type: '*/*' }), async (req, res) => {
  res.status(200).end();                               // empty 200 first
  const raw = req.body.toString('utf8');               // original order and encoding
  const sandbox = /(^|&)test_ipn=1(&|$)/.test(raw);
  const url = sandbox ? 'https://ipnpb.sandbox.paypal.com/cgi-bin/webscr' : 'https://ipnpb.paypal.com/cgi-bin/webscr';
  const r = await fetch(url, { method: 'POST', body: 'cmd=_notify-validate&' + raw,
    headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'MyShop-IPN-Listener' } });
  if ((await r.text()) !== 'VERIFIED') return;          // log INVALID and stop
  // then check payment_status, receiver_email, amount/currency and that txn_id is new
});

Once you get VERIFIED, PayPal's docs still tell you to check the payment status, the receiver, the amount and currency, and that you haven't already processed that txn_id.