Supabase email problemWhy do my Supabase sign-up emails go to spam, and how do I fix it?

Fix it in this order

1. 01

   You’re still on Supabase’s built-in sender

   “Work with your email sending service to configure DKIM, DMARC and SPF for your sending domain.” Supabase, Send emails with custom SMTP

   Supabase’s built-in sender is not meant for production: it only delivers to your project’s team, and it currently sends 2 messages an hour, a limit Supabase says can change without notice. Real users need custom SMTP from an email provider, set on the SMTP settings page under Authentication in the Supabase dashboard, sending from an address on your own domain.

2. 02

   Your sending domain isn’t verified, so SPF and DKIM fail

   “Set up SPF or DKIM email authentication for your sending domains.” Google, Email sender guidelines

   SPF and DKIM are DNS records that prove your email provider may send as your domain; DMARC, below, tells inboxes what to do when they fail. Adding your domain in the email provider gives you the records to add where your domain is managed. Resend says SPF and DKIM are set up automatically once the domain is verified, so wait until the provider shows it as verified. Google’s sender guidelines ask for SPF or DKIM from every sender. Caution: if your domain already sends email, for example staff mail, it may already have an SPF record. Ask your email provider how to combine them rather than adding a second one.

3. 03

   The From: address doesn’t match the verified domain

   “For direct email, the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain.” Google, Email sender guidelines

   The domain in the From: address must match the domain you verified. If it uses a Gmail address or an old domain instead, the checks fail even though the records exist. Use an address on the verified domain, such as no-reply@ or hello@ on it.

4. 04

   No DMARC record

   “An email must pass either SPF or DKIM checks (but not necessarily both) to achieve DMARC compliance and be considered authenticated.” Resend, DMARC

   DMARC is one more DNS record, named _dmarc, that tells inboxes what to do with email that fails SPF and DKIM. Check first whether your domain already has one: if it does, edit it, and don’t add a second. Start with p=none and an address that can receive the reports. Move to quarantine or reject only once your sign-up emails and your other email, such as staff mail, all pass, or the stricter setting can block that mail.

   _dmarc.example.com  TXT  v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com;

5. 05

   Links point at Supabase’s shared address

   “Setting up a custom domain will reduce the likelihood of your messages being picked up as spam due to another Supabase project's bad reputation.” Supabase, Send emails with custom SMTP

   Sign-up and reset emails link to your project’s Auth server. Without a custom domain, that link sits on Supabase’s shared address, so Supabase suggests a custom domain to keep other projects’ reputation off your emails.

6. 06

   Tracking on sign-up emails

   “It would seem like adding open and click tracking would be ideal to gather this information, but this has been seen to negatively impact your inbox placement.” Resend, How to avoid Gmail’s spam folder

   Resend’s guide says open and click tracking has been seen to hurt inbox placement, so turn it off for sign-up and password reset emails.

7. 07

   A brand new domain, a different website, or marketing on the same address

   “Make sure that the domain you send with is the same domain where your website is hosted.” Resend, How to avoid Gmail’s spam folder

   Resend says sending a large volume from a new domain tends to land in spam, so start small. Send sign-up emails from your website’s domain. Supabase says not to mix Auth emails with marketing, so send newsletters from a separate subdomain or address, and complaints about them don’t drag down your sign-up emails.

Checked against the vendor’s docs on November 1, 2026: Google: Email sender guidelines; Resend: How to avoid Gmail’s spam folder; Resend: DMARC; Resend: Domains; Supabase: Send emails with custom SMTP; Twilio SendGrid: Configure domain authentication.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

• from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
• from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.See scope and start

Related: Supabase email rate limit exceeded · Supabase emails link to localhost · Supabase staging environment · Supabase RLS fixes