Supabase confirmation emails not arriving for new users

Short answer: if you haven't set up your own email provider, Supabase's built-in sender is doing the sending, and it isn't meant for real customers. Supabase's docs say it only delivers to email addresses on your project's team, fails for everyone else with "Email address not authorized", and is limited to a few messages per hour (2 per hour when we checked their docs on October 25, 2026). It works when you test with your own address, then fails for strangers. The fix is to connect a real email provider under custom SMTP in your Supabase Auth settings.

Signs this is your problem

Sign-up works when you try it with your own email, but new users say the confirmation email never came.
Your Supabase Auth logs show "Email address not authorized" or a rate limit error when someone signs up.
Magic links or password-reset emails stop arriving after the first couple of tries in an hour.
Emails do arrive, but in the spam folder.

Why it happens

Every Supabase project starts with a shared email sender so you can try out sign-up and edit your email templates. It has three limits that matter once real people arrive:

It only sends to your team. Without custom SMTP, Supabase refuses to email any address that isn't a member of your project's organization. Your own test sign-ups work; customers' don't.
It has a very low hourly limit that Supabase says can change without notice.
It has no delivery guarantee. Supabase describes it as best-effort, for demos and testing.

AI builders often wire up email-and-password sign-up with confirmation turned on, and nothing tells you the sender is still the testing one. So the app looks finished, and the first strangers get stuck at "check your inbox".

The fix: connect your own email provider

Pick a transactional email service that supports SMTP. Supabase's docs list Resend, Amazon SES, Postmark, SendGrid, ZeptoMail and Brevo, among others.
In that service, add your domain and copy the DNS records it gives you (SPF and DKIM, and add a DMARC record too) into wherever your domain's DNS lives. Wait until the service shows the domain as verified.
In Supabase, open Authentication, find the SMTP settings, turn on custom SMTP and enter the host, port, username and password from your email service. Use a From address on your own domain, like no-reply@yourdomain.com.
Check the email rate limit in Supabase's Auth rate limit settings. Supabase's docs say it starts low (30 per hour) after you switch on custom SMTP; raise it to fit how many sign-ups you expect.

Prompt idea for your builder: "We use Supabase Auth with email confirmation. Don't turn confirmation off. List every place the app sends auth email (sign-up, magic link, password reset, email change) and make sure each confirmation link uses our production domain."

Don't fix it by turning confirmation off

Switching off email confirmation makes sign-up "work", but then anyone can create an account with someone else's email address. Supabase's own docs advise against disabling confirmations under pressure. Fix the sending instead.

If emails arrive but land in spam

Make sure SPF, DKIM and DMARC all pass for your sending domain. Most email services show this on the domain page.
Keep auth emails plain: a short subject, one clear link, no marketing lines or lots of images.
Send auth email and newsletters from different addresses (ideally different subdomains), so a newsletter complaint can't hurt your sign-up emails.

If the email arrives but the link is broken

A link that opens localhost, an old preview address or an "invalid link" page is a different problem: your Site URL and Redirect URLs. See Login broke after I added my custom domain.

Check it like a stranger would

Open a private window and sign up with an email address that is not on your Supabase team, such as a fresh free address. Time how long the email takes, check it isn't in spam, click the link and make sure you land logged in on your real domain. Try a password reset too. Repeat after any change to your domain or email settings.

Source for the limits above: Supabase's guide "Send emails with custom SMTP" (supabase.com/docs/guides/auth/auth-smtp), read October 25, 2026. Supabase may change these numbers.

Check your live app in under a minute

AppFirstAid's free check looks at your live site from the outside: leaked keys, files left in public, safety settings, and whether your sign-up, login and checkout pages open. No signup. Journey tests that sign up, log in and try checkout like a real customer are coming soon (email us to hear when).

Run the free check

Settings move around as these tools update. If a menu name has changed, look for the same words nearby. Spotted something out of date? Tell us.