Why it happens
The project still sends its auth email through Supabase's built-in mailer. Supabase provides it so a project works on day one, says in the dashboard that it is for development, and rate-limits it to a few messages an hour. The first few sign-ups of the hour get their email; the rest get nothing, and the app never learns, because to the app the send succeeded.
How to tell
- Supabase › Authentication › SMTP settings shows custom SMTP off.
- The auth logs show 429 responses with over_email_send_rate_limit on the hours it happens.
- It comes and goes with traffic: quiet days are fine, a launch day is not.
- Sign-ups auto-confirmed still lose their password resets.
The fix
- Set up your own SMTP provider — Resend, Postmark, SendGrid or SES — from a domain you own, and add the SPF and DKIM records it gives you.
- In Supabase › Authentication › SMTP settings, turn custom SMTP on with the provider's host, port, user and password, and a sender address on your domain.
- Send yourself a password reset and a sign-up confirmation and open both links.
- Keep the built-in mailer for nothing: once custom SMTP is on, every auth email goes through your provider.
Where to look
The prompt for your builder
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever built the app. Replace anything in capitals. It never asks you to paste a secret into a chat; keys go into your host’s environment, by you.
My Supabase project sends its auth emails through the built-in mailer, which is rate-limited. I am setting up custom SMTP with PROVIDER. Tell me the exact SMTP host, port and user PROVIDER expects, which DNS records (SPF, DKIM, DMARC) I must add for MYDOMAIN, and the sender address to use — I will paste the SMTP password into the Supabase dashboard myself, not here. Then check my app's code for any place that assumes a sign-up is confirmed immediately.
How Keelnest catches it
Backend Guard reads which mailer the project sends through on every check and says so before the first launch-day sign-up is lost. A journey that types {{inbox}} into the sign-up form and waits for the email proves the mail arrives and the link in it works.
Know the moment this happens.
Keelnest watches your production app every five minutes and tells you in plain English what broke — with the fix. Free for your first app.
Related
- Confirmation emails land in spam, or vanishThe mail is sent — your provider shows it delivered — and people find it in spam, or never at all.The fix
- Sign-in breaks on your new domainYou moved to a custom domain. Existing sessions still work; new sign-ins fail after the magic link or the OAuth redirect, with “redirect_to is not allowed”.The fix