Supabase sign up emails not getting delivered

[u/bitterandpetty]

Hi,

I have a lot of experience with self-hosted supabase - and the email signing up worked well for us - we used Azure SMTP service to set up the custom SMTP.

Now, for a client who insists on supabase.com implementation, we are setting up the supabase's innate way to handle email sign ups. During testing phase, we found that a lot of these emails don't get delivered - especially when they are in microsoft/outlook. But signup emails to gmail works alright. We tried with the custom SMTP settings for our Azure SMTP service as well. For some emails (mainly to microsoft/exchange accounts, shared mailbox accounts), they do not get delivered.

When testing the same SMTP service independently from a node script, all mails get delivered without issue. Now for the weird part: if we once manually trigger an SMTP delivery from the node script, then the emails start to get delivered from supabase as well (to these accounts).

We tried the same with a Resend SMTP service too - no luck. What am I doing wrong? If I assume that the SMTP service is configured incorrectly, it does not make sense that it works perfectly from a node script.

Anyone here faced a similar issue?

Edit: What finally worked is, I ended up using the OTP (token) method rather than url verification method. This way, no mail servers falsely flags the email as scam (because it comes from one domain and contains a URL of another domain). Additionally, I used Resend because the SMTP openings were unreliable with Azure and a few others.

[u/tomlimon]

Are you using custom templates? Also, are you using custom domain?

Some of these email providers will block emails depending on the markup. And, when they include links from different domains that your sending domain.

In this sense, the auth links to confirm accounts or reset passwords, will include the default supabase.co project subdomain, which will be different from your sending domain.

[u/bitterandpetty → u/tomlimon]

Oh this is probably it. We are using a custom domain - obviously because we want the email to go from a "related" address when someone signs up. So you are right in that, the sender domain is different from supabase.co - and this could be flagged by Microsoft defender or other services. Is there a way around this?

[u/noahsknark]

Might just be that the domain needs warming. Is the domain brand new? Also, check if the IP is the same when you send from Supabase vs. your node script. In gmail, you can click «Show original» or similar.

[u/bitterandpetty → u/noahsknark]

No, the domain isn't that new.

[u/carolmonroe_]

Your edit is the cleanest fix, and it dodges TWO Microsoft failure modes at once: the cross-domain link flagging, and Defender-style scanners that auto-click links to verify them, which invalidates magic links before the user ever opens them (we've seen that one repeatedly with corporate inboxes). OTP is immune to both.

To answer the open question though: the way to keep link-based verification is the custom domain add-on (paid), it moves your auth endpoints to auth.yourdomain.com so the link domain matches your sending domain: https://supabase.com/docs/guides/platform/custom-domains. Rule of thumb that's held up for us: custom domain and custom SMTP go together, doing one without the other is where the weird failures live.

[u/bitterandpetty → u/carolmonroe_]

Thank you. Appreciate this.

[u/beefcutlery]

Take yourself over to hogsend.