Supabase Emails Not Arriving? Fix It With Resend, Step by Step

Guide · 7:55 videoChecked against the official sources

Sources checked 19 Oct 2026 · Published 21 Oct 2026 · Last reviewed 21 Oct 2026 · By Ctrl+Z Therapy (how we test)

The short answer

An app's email gets lost in one of four places: it was never sent, the email service blocked it, it landed in spam, or the link inside is broken. Look at the logs instead of guessing: your Supabase project's Auth logs first, then your email service's logs. Supabase's built-in email only sends to your project's team, 2 emails an hour, so for real users connect your own service such as Resend, verify a subdomain and send from that exact subdomain, keep a single SPF record and add DMARC, and set the Site URL to your live address instead of localhost.

Four places an email gets lost

It was never sent: the sender refused.
It was sent, but the email service blocked it.
It arrived, in spam.
It arrived, but the link inside is broken.
Turning off email confirmation is not the fix: then anyone can sign up with an email address that isn't theirs.

Check the logs first

Supabase's troubleshooting page gives the order. First, your project's Auth logs: in the dashboard, Logs, then Auth.
Then the logs at your email service, including its suppression list: the addresses it has stopped sending to.
Then the recipient's spam folder and firewall.
The same user can ask for a new email only once every 60 seconds by default, so pressing "resend" again and again won't help.

Supabase's built-in email is for testing

Without your own SMTP server, Supabase Auth only delivers to addresses that are part of your project's team. Everyone else is refused with the error "Email address not authorized."
The limit is 2 emails an hour; a brand-new project shows exactly that under Authentication, Rate Limits. Supabase says the limit can change without notice, and the default service has no delivery guarantee.
For real users, connect your own email service. Supabase's docs list Resend, AWS SES, Postmark, Twilio SendGrid, ZeptoMail and Brevo; the video uses Resend as the example.
Built your app on Lovable Cloud? You don't see these Supabase settings. On a free plan, emails come from Lovable's default sender. Sending from your own domain is under More, Cloud, Emails and needs a paid plan; Lovable sets up the DNS records for you.

Connect Resend to Supabase

Resend lists the four values under Settings, SMTP: host smtp.resend.com, port 465, username resend, and your Resend API key as the password.
In Supabase, open Authentication, Emails, then the SMTP Settings tab, and turn on Enable custom SMTP. Paste the four values; a sender email address and a sender name are required too.
Once custom SMTP is on, Supabase starts you at 30 emails an hour. You can raise it under Authentication, Rate Limits.
Resend answers "You can only send testing emails to your own email address"? You're still sending from Resend's test address, onboarding@resend.dev, which only delivers to your own address. To reach anyone else, verify your own domain and send from it.

Verify a subdomain

Resend strongly recommends a subdomain, such as auth.yourdomain or notifications.yourdomain, so your sign-up emails' reputation stays separate from anything else you send.
On the Domains page, click Add domain. Resend then shows a Records tab: the DNS records you add wherever your domain is managed.
Copy every record exactly as Resend shows it, not from an old screenshot: for domains created after August 2026, Resend may generate CNAME records instead.
Some DNS providers want only the short name in the Host field, not your whole domain. On Cloudflare, turn the orange cloud (proxy) off for these records.
Verification often takes about 15 minutes, and can occasionally take up to 72 hours.
Your "from" address must use the exact subdomain you verified. Verify auth.yourdomain but send from your main domain, and Resend says that domain isn't verified.
Resend's free plan sends 100 emails a day: fine to start, worth watching if you launch somewhere big.

Spam: SPF, DKIM and DMARC

Since 2024, Google asks every sender to Gmail to set up SPF or DKIM: two records that prove an email really came from your domain. Resend sets both up when you verify the domain.
DMARC isn't set up automatically; Resend strongly recommends it. Start with the gentlest policy, p=none: it only asks for reports and doesn't block anything.
A domain can have only one SPF record. If you already have one, from Google Workspace for example, merge the new part into it. Google says that with two SPF records your mail can end up in spam.
Sending from a personal Gmail account? It hits a limit after about 500 emails a day and can then stop sending for up to 24 hours, and Google says app passwords, which you'd need for that, aren't recommended. For an app, use your own domain.

Broken links: Site URL and link scanners

The email arrives but the link opens localhost: that's the Site URL. Supabase's default is http://localhost:3000, and the docs say to change it to your production URL, calling it critical for email confirmations and password resets.
It's under Authentication, URL Configuration. If your code sends users to a specific address with redirectTo, that address has to match the Redirect URLs list too.
Some email providers scan links before the user clicks; Microsoft Defender's Safe Links is the example in Supabase's docs. The scan uses up the one-time link, and your user sees "Token has expired or is invalid".
Supabase gives two fixes: send a code instead of a link, or send the link to a page with a confirm button, so only a real click counts.
Turn off link tracking at your email service: Supabase and Resend both say it can break these links.

Checklist

Check the logs first: Supabase Auth logs, then your email service.
Built-in Supabase email is for testing. Connect your own service for real users.
Verify a subdomain, and copy the records exactly.
Send from that exact subdomain.
One SPF record. Add DMARC, starting with p=none.
Site URL is your live address, not localhost.
Turn off link tracking, and plan for link scanners.

Sources

Checked on 19 Oct 2026. Prices, limits and settings change, so check the source before you rely on them.