Supabase Auth Emails Going to Spam? Causes and Fixes (2026)

First check whether the email was sent at all. Supabase's default sender is a test service restricted to team members and 2 emails per hour. If you're already using custom SMTP and messages arrive in spam, investigate domain authentication, alignment, templates, and sender reputation. These are two different diagnoses.

Last validated: September 2026 against Supabase's custom SMTP docs⁠ and Google's email sender guidelines⁠.

Are you still using the default test sender?

Supabase's default email service only sends to members of your Supabase organization, allows at most 2 emails per hour, and has no delivery SLA. An email_address_not_authorized error for a real user is not a spam-filter diagnosis: the sender is restricted. A rate-limit error likewise means the email wasn't sent.

Switch to custom SMTP or a Send Email Hook before testing production delivery. Dreamlit's Supabase Auth setup⁠ configures the hook for its auth workflows. Your app still triggers the Supabase Auth methods and handles redirects or codes.

Why do custom SMTP auth emails go to spam?

Mailbox providers like Gmail and Outlook decide where an email lands based on who sent it, whether that sender can prove it's allowed to, and how recipients have treated its past emails. For Supabase auth emails, fix the first two before anything else.

These checks apply after your production sender accepts the message. Check provider delivery logs as well as Supabase Auth logs: an accepted send is different from delivery, and delivery is different from inbox placement.

How do I fix Supabase emails going to spam?

If you already use custom SMTP, start at step 2. If you use a Send Email Hook, check that sender's domain setup and logs instead of changing SMTP settings.

1. Switch to custom SMTP

1. Pick an email provider. Supabase's docs list Resend, Amazon SES, Postmark, Twilio SendGrid, ZeptoMail, and Brevo. For a comparison, see best transactional email services.

2. Add and verify your sending domain with that provider.

3. In Supabase, go to Authentication > Emails > SMTP Settings and turn on Enable Custom SMTP.

4. Enter the host, port (587 is the usual choice), username, password, sender email, and sender name:

   SMTP Host: smtp.yourprovider.com SMTP Port: 587 SMTP User: your_smtp_username SMTP Password: your_smtp_password Sender email: no-reply@auth.yourapp.com Sender name: YourApp

5. Supabase then limits you to 30 emails per hour to protect your new sender. Raise it under Authentication > Rate Limits before launch.

Hook alternative: in Dreamlit, connect Supabase, open Settings > Database Connections, select the connection, and click Setup Supabase Auth. This creates six branded auth workflows and configures the Supabase Auth Hook. Set up your sending domain⁠, trigger a password reset from your app, and verify both delivery and the completed auth flow. This handles templates and delivery; it does not guarantee inbox placement.

The guide to sending emails from Supabase covers this step and the Send Email Hook alternative in more detail.

2. Authenticate your domain with SPF, DKIM, and DMARC

These three DNS records let receivers check that email using your domain really comes from you. Your provider shows the exact values when you add the domain. Copy them rather than writing your own.

SPF lists the servers allowed to send for your domain:

Type: TXT Name: @ (or your sending subdomain) Value: v=spf1 include:yourprovider.com ~all

A domain can have only one SPF record. If you already have one (for Google Workspace, say), add your provider's include: to it instead of creating a second.

DKIM adds a cryptographic signature to each email. Your provider gives you the record name, which includes a selector:

Type: TXT (or CNAME, depending on the provider) Name: <selector>._domainkey Value: the value your provider gives you

DMARC requires SPF or DKIM to pass for the domain in your From address, tells receivers what to do when neither does, and says where to send reports:

Type: TXT Name: _dmarc Value: v=DMARC1; p=none; rua=mailto:dmarc@yourapp.com

Start with p=none to monitor, then move to quarantine or reject once the reports show your real email passing.

Gmail requires SPF or DKIM from every sender. Anyone sending about 5,000 or more messages a day to Gmail addresses needs all three, plus DMARC alignment and a spam complaint rate below 0.3%. Our free SPF and DKIM record generators help if you're writing records by hand.

3. Send from a branded address on that domain

The From address has to use the domain you just authenticated, or another subdomain of the same parent domain (DMARC's default relaxed alignment allows that). no-reply@auth.yourapp.com sent through a provider that signs for auth.yourapp.com passes. The same provider sending as hello@gmail.com or no-reply@otherdomain.com doesn't.

A subdomain like auth.yourapp.com or mail.yourapp.com for app email has a side benefit: if you later send newsletters from another subdomain, a bad campaign is less likely to drag your password resets into spam.

4. Clean up the templates

Edit the templates under Authentication > Emails. For auth emails, less is more:

• A specific subject: "Your YourApp sign-in link," not "Confirm your mail."
• One clear link or button, plus the raw URL as text for clients that break buttons.
• Real text, not an image. Image-only emails look like spam.
• No link shorteners, and link to your own domain where you can.
• No marketing. Keep promotions out of password resets and magic links.

The Supabase email templates guide has a full example template and every variable you can use.

5. Ramp volume slowly on a new domain

A brand-new domain has no sending history, so receivers are cautious. If you're migrating a large user base or expecting a launch spike, start with your normal daily signups and grow from there rather than sending thousands of emails on day one. Auth emails have an advantage here: recipients asked for them and are expecting them.

How do I check whether my emails are landing in spam?

Check each email with your own inbox, then watch the trend:

1. Read the headers. Send an auth email to a Gmail address, open it, and choose Show original. SPF, DKIM, and DMARC should all say PASS. In other clients, look for the Authentication-Results header.
2. Test across providers. Send to Gmail, Outlook, and Yahoo test addresses and check the inbox and spam folders.
3. Set up Google Postmaster Tools⁠ for your domain. Once you send enough volume to Gmail, it shows your spam rate and whether you're meeting Gmail's requirements.
4. Watch your provider's dashboard for bounces and complaints.

Before launch, the free Supabase email checker reviews your sender setup, redirect URLs, and DNS in one pass.

Common Supabase email delivery errors

For bounce handling and list hygiene beyond auth emails, see how to reduce your email bounce rate.

Where Dreamlit fits

For Supabase Auth delivery, Dreamlit offers the Auth Hook setup above, with branded templates you can edit. Domain authentication and sender reputation still matter. For the lifecycle emails after signup, add Dreamlit to your AI agent and ask it to build a workflow over your Supabase database, with a real-data preview before you publish.

Once auth works, build a welcome sequence with your agent. Keep that optional follow-up separate from the password resets and sign-in codes users need to access their accounts.

Start a 7-day free trial⁠ or connect your agent. 7-day free trial. Card required. Cancel anytime.

References

1. Supabase: Send emails with custom SMTP⁠
2. Supabase: Auth rate limits⁠
3. Supabase: Email templates⁠
4. Google: Email sender guidelines⁠
5. Google: Email sender guidelines FAQ⁠
6. Google Postmaster Tools⁠

---

Frequently asked questions

Why are my Supabase auth emails going to spam?

First check your sending path. Supabase's default test sender only reaches team members and is rate limited, so missing email to other users is a setup issue. For custom SMTP email that arrives in spam, check domain authentication, alignment, and reputation. A From address that doesn't match your sending domain, link-heavy templates, and a brand-new domain make it worse.

Does custom SMTP fix Supabase emails going to spam?

Only together with domain authentication. Custom SMTP lets you send from your own domain, and the SPF, DKIM, and DMARC records your provider gives you let mailbox providers verify it. Gmail requires at least SPF or DKIM from every sender, though authentication alone doesn't guarantee the inbox.

What DNS records do I need for Supabase auth emails?

An SPF record that includes your email provider, the DKIM record (or records) your provider generates, and a DMARC record starting at p=none. Gmail requires SPF or DKIM from every sender, and all three from anyone sending about 5,000 or more messages a day to Gmail.

Should Supabase auth emails include an unsubscribe link?

No. Password resets, magic links, and confirmations are emails the user asked for, so they don't need one. Unsubscribe links belong on marketing and newsletter emails, which should come from a separate sender.

How can I check whether my emails pass SPF, DKIM, and DMARC?

Send an auth email directly to a Gmail address (not through a forwarding address), open it, and choose Show original. Gmail lists SPF, DKIM, and DMARC as PASS or FAIL at the top. A FAIL on a direct send usually points to your DNS records or From address.

Why do Outlook users say my magic link has expired?

A security scanner may have used the link first. Corporate security tools such as Microsoft Defender's Safe Links can open links before the user does, which uses up the one-time token. Supabase suggests emailing the 6-digit code from the Token variable instead of the link, or linking to your own page where the user clicks a button to confirm.