--- title: "Confirmation and password-reset emails never arrive" description: "Supabase's built-in mailer sends 2 emails an hour and only to your team. How to add custom SMTP, raise the limit, and fix the links so users get in." url: https://whocanfixmyapp.com/problems/confirmation-and-password-reset-emails-never-arrive --- [Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / [Sign-in and accounts](https://whocanfixmyapp.com/problems#sign-in-and-accounts) # Confirmation and password-reset emails never arrive VC-25 · Supabase · Lovable · Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley) Quick verdict Partly fixable yourself. Needs an email provider account plus Supabase settings. - **How serious**: High - **Fix it yourself?**: Partly, some steps need a developer - **Typical cost**: $49–$800 one-off check, or €99–$990 for a single fix ([prices](https://whocanfixmyapp.com/pricing)) - **Top rated for Supabase**: [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 **What you see.** New users never get the confirmation email, and Forgot password sends nothing, so nobody can get in. ## Why it happens Supabase ships with a built-in email service meant for testing only. It sends 2 messages per hour per project, and only to pre-authorized addresses, meaning members of your Supabase organization. Everyone else fails with `Email address not authorized` and never sees the message. Supabase urges every production project to set up a custom SMTP server, meaning your own account with an email provider. Lovable projects on the built-in backend run on the same Supabase engine, so the same limit applies. A second cause is the link inside the email. Confirmation and reset links send the user to the Site URL or a `redirectTo` address, and that address must be on the Redirect URLs allow list. If it still points to `localhost:3000`, the email arrives but the link opens a dead page. A third cause is per-user throttling. Supabase allows one confirmation or reset request per 60 seconds, so rapid retries silently fail. ## Fix it yourself 1. Open **Authentication → Users** in Supabase and find the stuck account. A missing confirmed date means the email was never delivered. 2. Create an account with a transactional email provider and verify your sending domain there. Copy the SMTP host, port, username, and password. 3. In Supabase, open the **SMTP Settings** page under **Authentication**, enable custom SMTP, paste the values, and set a sender address on your own domain. 4. Open **Authentication → Rate Limits** and raise the emails per hour limit to fit your expected sign-ups. 5. Open **Authentication → URL Configuration** and set **Site URL** and **Redirect URLs** to your live domain so the links in emails open the right page. 6. Sign up with a personal address that is not on your team. The email should arrive within a minute. ## When to get an engineer Stop if the Supabase auth logs show the email was sent but it never arrives, which points at domain records such as SPF and DKIM at your email provider, or if the links open but the app shows an error after the click. Give the engineer your email provider, the sending domain, and a screenshot of the auth log. A check is $49–$800, or a single fix €99–$990, within 1–2 days. ## Top-rated companies for Supabase apps Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score). - 1 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490 - 2 · [Vibe Code Rescue (Lev Arakelyan)](https://whocanfixmyapp.com/companies/vibe-code-rescue-lev-arakelyan) · **9.0**/10 · Best for: A one-off check and a cleanup · From $299 - 3 · [LazyCodeLab](https://whocanfixmyapp.com/companies/lazycodelab) · **9.0**/10 · Best for: A one-off check and a cleanup · From $399 [All 29 Supabase companies, ranked](https://whocanfixmyapp.com/best/supabase-developers) ## Check these AUTH-01 · High Sign-up confirmation and password reset work end to end Use a real inbox. Check that the link arrives, points to your live domain, and works once. AUTH-03 · Medium Sign-in and sign-up are rate limited Without limits, bots create thousands of accounts and run up your email and AI bills. OPS-03 · High Errors reach you before users do Add error monitoring and uptime alerts. If you learn about outages from customers, this is missing. ## Questions ### Why did emails work when I tested with my own address? Your address belongs to the Supabase organization, so the built-in service was allowed to send to it. Anyone outside your team is blocked until you add custom SMTP. ### Should I just turn off email confirmation? Not for a live product. Without it, anyone can register with an address they do not own, and password reset still needs working email. Fix delivery instead. Sources: [Supabase: Send emails with custom SMTP](https://supabase.com/docs/guides/auth/auth-smtp); [Supabase: Auth rate limits](https://supabase.com/docs/guides/auth/rate-limits); [Supabase: Password-based auth](https://supabase.com/docs/guides/auth/passwords); [Supabase: Redirect URLs](https://supabase.com/docs/guides/auth/redirect-urls). **Lovable guide** What Lovable builds, where it breaks and how to check it: [Lovable app rescue: what breaks and how to check it](https://whocanfixmyapp.com/guides/lovable). **Same category** - [Users can't log in on the live site](https://whocanfixmyapp.com/problems/users-cant-log-in-on-the-live-site) - [Google sign-in fails with redirect_uri_mismatch](https://whocanfixmyapp.com/problems/google-sign-in-redirect-uri-mismatch) - [Users get logged out when they refresh the page](https://whocanfixmyapp.com/problems/users-get-logged-out-on-refresh) - [Admin pages open to anyone with the link](https://whocanfixmyapp.com/problems/admin-pages-open-to-anyone-with-the-link) - [Users can see each other's data](https://whocanfixmyapp.com/problems/users-can-see-each-others-data) - [Supabase says "new row violates row-level security policy"](https://whocanfixmyapp.com/problems/supabase-rls-blocking-insert) [All sign-in and accounts problems](https://whocanfixmyapp.com/problems#sign-in-and-accounts) **Run every check** The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.