Description

Ensure the project uses a custom SMTP provider, such as AWS SES, SendGrid, Postmark, or Resend, to send authentication emails like confirmations, magic links, and password resets. Emails should be sent from a domain the organization owns, with SPF, DKIM, and DMARC configured.

Rationale

The built-in Supabase email service is only meant for testing. It has a very low sending limit and sends from a Supabase address, so emails may be delayed, rejected, or look suspicious to users. A custom SMTP provider sends emails from your own trusted domain, improves delivery, and makes phishing emails that pretend to be from your app easier for users to spot.

Impact

  • Auth emails come from your own trusted domain

  • Removes the low built-in email sending limit

  • Requires an account with an email provider

Default Value

By default, projects use Supabase's built-in email service, which is limited to a few emails per hour and intended only for testing.

Pre-Requisites

  • Project Owner or Admin role

  • SMTP credentials from an email provider

  • A sending domain with SPF, DKIM, and DMARC configured

Test Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Authentication in the sidebar, select Emails, and open SMTP Settings.

  4. Verify that Enable Custom SMTP is turned on and that a sender address on your own domain is configured.

  5. If custom SMTP is not enabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Authentication in the sidebar, select Emails, and open SMTP Settings.

  4. Turn on Enable Custom SMTP.

  5. Enter the host, port, username, password, sender email, and sender name from your email provider.

  6. Select Save.

  7. Send a test sign-up or password reset email and confirm it is delivered.

Backout Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Authentication in the sidebar, select Emails, and open SMTP Settings.

  4. Turn off Enable Custom SMTP.

  5. Select Save.

Reference