Supabase confirmation email not sending: why new users never get it

It worked every time you tried it. Then real people sign up, wait for the confirmation email, and nothing comes. Supabase's built-in sender only delivers to addresses on your project's team, sends 2 messages an hour, and is not meant for production. Your own address is on the team. A stranger's is not.

Sign-up only finishes when the person clicks the link or enters the code in that email. Whatever sends your app's emails decides who gets them, how many go out per hour and whether they land in the inbox. The default senders are made for trying things out, not for strangers arriving from an ad or a post.

Here are the seven causes, and the fix for each.

1. Supabase's default sender only delivers to your team

Unless you set up your own SMTP server, Supabase only sends to addresses that are part of the project's team. Everyone else's message fails (the error code is email_address_not_authorized).

Fix:

• From your email provider, get the SMTP host, port, user and password, and choose a From address on your own domain (for example [e-mail]).
• In the Supabase dashboard, open the Authentication settings page and enable custom SMTP.
• Enter the host, port, user, password and From address, and save.
• Sign up with an address that is not on your team and confirm the email arrives.

Source: Supabase: Send emails with custom SMTP

2. The hourly email limit was reached

The default service sends 2 messages per hour for the whole project. Once custom SMTP is saved, Supabase starts you at 30 messages per hour. A few sign-ups close together, or a launch day, use that up and later people get nothing.

Fix:

• Set up custom SMTP first (cause 1). Supabase says the email limit can be configured once you use custom SMTP or a Send Email hook.
• Open Authentication, Rate Limits in the dashboard.
• Raise the email limit to fit the sign-ups you expect, within what your email provider allows.

Sources: Supabase: Send emails with custom SMTP · Supabase: Rate limits

3. Your own sender is connected, but the hand-over fails or mail lands in spam

Supabase hands the message to your provider. A wrong setting stops that hand-over; after it, Supabase says it "has no control over email delivery". Providers keep suppression lists of addresses that bounced before, and recipients' mail filters can quarantine or spam the message.

Fix:

• Check your project's Auth logs first; a failed hand-over shows there.
• Then check your email provider's own logs for blocked or suppressed addresses.
• With your provider, set up DKIM, DMARC and SPF for the sending domain.
• Send from your own domain, and keep sign-in emails separate from marketing emails.

Sources: Supabase troubleshooting: Not receiving Auth emails · Supabase: Send emails with custom SMTP

4. Lovable: the project's hourly email cap

Apps on Lovable's built-in backend have a per-project "Rate limit for sending emails" that caps sign-in emails per hour; Lovable says it is the first thing to check when confirmations stop arriving after many sign-ups. Lovable's Emails feature also limits authentication emails per workspace per hour (Pro 500, Business 3,000, Enterprise 10,000), and at a workspace limit new emails are rejected until the hour resets.

Fix:

• Open More, Users, Settings, Email, and look under Advanced for "Rate limit for sending emails".
• Raise it to match your expected sign-ups. Lovable notes that raising the sending limit needs managed email or a verified custom domain first.
• Open More, Emails to see the workspace usage; Lovable shows a warning at 80% of a limit.

Sources: Lovable: Email authentication for your app · Lovable: Send branded emails from your own domain

5. Lovable: emails from a new domain land in spam

Lovable says emails from new domains often land in spam. On a paid workspace you can send sign-in emails from your own domain, with Lovable handling the DNS, SPF, DKIM and DMARC.

Fix:

• Ask people who are waiting to check their spam folder first.
• Open More, Emails and click Get started (a paid workspace, a domain you own and access to its DNS are required).
• Enter your domain, keep or change the sender subdomain, then click Set up domain.
• Add the records Lovable shows. Add the NS records inside your DNS zone for the subdomain host shown; do not replace your domain's nameservers at your registrar.
• Wait for the status to show Verified (usually a few hours, up to 72), then send a test sign-up.

Source: Lovable: Send branded emails from your own domain

6. Base44: the 6-digit code never arrives

Base44 sends a 6-digit code that works for 10 minutes, from [e-mail] unless you set up your own email domain. Email verification cannot be turned off, so a person without the code cannot log in with their password.

Fix:

• Ask the person to check spam or junk, wait a few minutes, add [e-mail] to their safe senders and check the address for typos.
• They can ask for a new code from the verification screen, or sign up again with the same address.
• If it still fails, remove their record from the Users list and ask them to sign up again. If several people report it at once, contact Base44 Customer Care with your app URL and the affected addresses.
• To send from your own domain (Starter plan or above, with a domain connected): Dashboard, Domains, Email domain, Use Your Custom Domain. Add the 3 CNAME records Base44 shows and wait for the status to be Active (up to 48 hours).

Sources: Base44: Managing login and registration · Base44: Sending emails from a custom domain

7. The person missed the first email and cannot get another

A person who deleted the email or typed a wrong address is left with an unconfirmed account. In Lovable, signing in again does not resend the email.

Fix:

• Supabase: give the app a "resend email" button that calls supabase.auth.resend with type signup and the person's address.
• Lovable: the person signs up again with the same address. You can also add them yourself under More, Users, Add user, Create new user; users added this way are confirmed automatically.

Sources: Supabase JavaScript reference: resend() · Lovable: Email authentication for your app

Why you can't see it yourself

You're signed in, your customers aren't. Your own address is on the team, so Supabase's default sender accepts it. You sign up once, so you never reach an hourly limit. Your mail provider knows you. A new customer is outside every one of those.

FAQ

How many emails can Supabase send per hour? The default service sends 2 per hour. After you set up custom SMTP, Supabase starts at 30 per hour, which you can change on the Rate Limits page. Your email provider may have its own limits.

Can I turn off email confirmation? In Supabase, Confirm email is a setting, and Supabase says it is on by default for hosted projects. Lovable has an Auto-confirm email switch. Base44 does not let you turn verification off. Without confirmation, people get in without proving the address is theirs.

Fixed it? Prove a real stranger gets in

A fix that works from your own account proves nothing about a new customer. Your AI reads your code. VibeFix signs up like a stranger.

Free check. Paste your live app's link at vibe-fixer.com: an AI agent signs up to your live app once as a brand-new person, with a real inbox of its own, on a phone and on a computer, and shows how many problems a new user still hits, what each one is, and one screenshot. No account needed. It never changes your app and never emails your users.

$9 for one app. If something is still broken, $9 tells you which of these causes is breaking your app and where, gives you a fix prompt written for your app, and includes 3 re-checks so you can see the result from the outside. It does not promise a fix; it shows what the agent saw.

Related: Supabase "Error sending confirmation email" (500) · Supabase "Email not confirmed" error · Confirmation link opens localhost

VibeFix is independent. Supabase, Lovable, Bolt and Base44 are trademarks of their owners.

Have you signed up to your own live app with an address that isn't on your team, and did the email arrive?

Originally published at vibe-fixer.com. I'm building VibeFix, an AI agent that signs up to your live app like a brand-new person and shows what breaks.