Supabase auth emails land in spam

What it means in plain English

The message was sent, and the inbox filed it as spam. Supabase's built-in SMTP is for trying Auth, not for real users. It only delivers to your organization's team members, it is limited to 2 messages an hour, and Supabase says it has no delivery guarantee. Other addresses fail with Email address not authorized instead of landing in spam. See Email address not authorized.

Likely causes

• Custom SMTP is off, so mail still comes from the shared default service. Supabase says a custom domain on the Auth server reduces the chance that another project's reputation marks your mail as spam.
• SPF, DKIM, and DMARC are not set on the domain you send from. Supabase says to set all three with your email provider.
• The confirmation template reads like marketing. Supabase says promotional copy, extra links, images, emojis in the subject, and mixed marketing branding make filters treat auth mail as marketing.
• Auth mail and newsletter mail share one domain and one From address. Supabase says to split them, for example auth.example.com and marketing.example.com.

How to fix it, step by step

1. Pick an SMTP provider. Supabase's list includes Resend, AWS SES, Postmark, Twilio SendGrid, ZeptoMail, and Brevo. Any service that speaks SMTP works. Copy the host, port, user, password, and a From address such as no-reply@example.com.
2. In the Supabase dashboard, open the Authentication settings and enable custom SMTP. The Management API fields on the same guide are smtp_host, smtp_port, smtp_user, smtp_pass, smtp_admin_email, and smtp_sender_name, with external_email_enabled true.
3. At the DNS host, add the SPF, DKIM, and DMARC records your email provider gives you. Supabase does not publish those records for you.
4. If you can, put Auth on its own domain. Supabase's custom-domain guide is the one they link for this. Keep marketing mail on a different domain and a different From address.
5. Shorten the auth template. Supabase says to leave out promotional text, cut links and images, and keep the subject short. After you save SMTP, Auth can mail any address, starting at 30 messages an hour. Raise that under Authentication → Rate Limits if you need more. Hitting the limit is email rate limit exceeded. A message that never arrives at all is confirmation email not arriving.
6. Paste this to the AI tool:

Supabase confirmation emails go to spam. Do not change the signup flow. I am enabling custom SMTP in the Supabase Authentication settings. Keep the auth email template short: no marketing, no extra images, and a plain subject. The confirmation link must use the Site URL, not localhost.

How to check it worked

• Send a signup or reset to an inbox that is not on your Supabase team. It arrives in the inbox, or the provider's logs show it was accepted.
• The link opens your live domain.
• Authentication logs do not say the address is not authorized, and you are under the rate limit you set.

Sources

• https://supabase.com/docs/guides/auth/auth-smtp (opens in a new tab)
• https://supabase.com/docs/guides/auth/rate-limits (opens in a new tab)
• https://supabase.com/docs/guides/auth/redirect-urls (opens in a new tab)