--- title: "Transactional emails not sending from my app" description: "Emails that only reach you usually mean the default Supabase mail service with its 2 per hour, team-only limit. How to set up SMTP and fix app emails." url: https://whocanfixmyapp.com/problems/transactional-emails-not-sending --- [Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / [AI APIs and integrations](https://whocanfixmyapp.com/problems#ai-apis-and-integrations) # Transactional emails not sending from my app VC-62 · Supabase · Lovable · Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley) Quick verdict Partly fixable yourself. SMTP is a dashboard task, app emails need code. - **How serious**: High - **Fix it yourself?**: Partly, some steps need a developer - **Typical cost**: €99–$990 for a single fix ([prices](https://whocanfixmyapp.com/pricing)) - **Top rated for Supabase**: [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 **What you see.** Confirmations, password resets, receipts or notifications never arrive, or they only arrive at your own email address. ## Why it happens Your app sends two kinds of email. Auth emails, like confirmations and resets, come from Supabase. App emails, like receipts and invites, come from code the AI wrote. They fail for different reasons. Supabase's built-in email service is for testing only. It sends at most 2 emails per hour, and until you set up custom SMTP it only delivers to addresses on your own project team. Anyone else gets Email address not authorized. That is why it works for you and nobody else. Once custom SMTP is on, a default limit of 30 emails per hour applies and can be raised under Rate Limits. App emails fail because the AI wrote the send call but never connected a provider, or placed the provider's key in the browser where it is exposed and often rejected. Mail from a domain without SPF, DKIM and DMARC records also lands in spam. ## Fix it yourself 1. Work out which kind is missing. For auth emails open Supabase **Logs**, choose **Auth**, and look for Email address not authorized or a rate limit message. 2. Create an account with an email provider. The Supabase docs list Resend, AWS SES, Postmark, Twilio SendGrid, ZeptoMail and Brevo. Get the host, port, username and password. 3. In Supabase open **Authentication**, then the **SMTP Settings** section, enable custom SMTP, and enter those details with a from address on your own domain. 4. Add the SPF, DKIM and DMARC records your provider shows you to your domain's DNS. Then send a test to an address outside your team and check spam. 5. Before a launch, raise the email limit under **Authentication**, **Rate Limits**, since 30 new users per hour is the default. 6. For receipts and notifications, have the send call moved to a server function with the provider key in secrets. See also [confirmation emails never arrive](https://whocanfixmyapp.com/problems/confirmation-and-password-reset-emails-never-arrive). ## When to get an engineer Get an engineer for the app emails, because sending from a server function with templates, retries, and a log of what was sent is code work. Tell them which emails you expect, which provider you chose, and whether SMTP for auth is already working. A single fix is €99–$990, about two days. Ask them to confirm sign-up and reset work end to end, check AUTH-01 on the [checklist](https://whocanfixmyapp.com/checklist). ## Top-rated companies for Supabase apps Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score). - 1 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490 - 2 · [Vibe Code Rescue (Lev Arakelyan)](https://whocanfixmyapp.com/companies/vibe-code-rescue-lev-arakelyan) · **9.0**/10 · Best for: A one-off check and a cleanup · From $299 - 3 · [LazyCodeLab](https://whocanfixmyapp.com/companies/lazycodelab) · **9.0**/10 · Best for: A one-off check and a cleanup · From $399 [All 29 Supabase companies, ranked](https://whocanfixmyapp.com/best/supabase-developers) ## Check these AUTH-01 · High Sign-up confirmation and password reset work end to end Use a real inbox. Check that the link arrives, points to your live domain, and works once. OPS-04 · Medium Secrets live in the host's environment settings Keys belong in environment variables on the server, not in the repository or in front-end code. OPS-03 · High Errors reach you before users do Add error monitoring and uptime alerts. If you learn about outages from customers, this is missing. DATA-02 · Critical No secret keys reach the browser Open your live app, then DevTools, Sources, and search the loaded JavaScript for `sb_secret_`, `sk_live_`, `sk-proj-` and `sk-ant-`. Older Supabase keys are long tokens starting with `eyJ`: decode the middle part of each on your own machine, and if it contains `"role":"service_role"`, your secret key is public. A publishable or anon key in the browser is expected. ## Questions ### Can I launch on the default Supabase email service? No. It is capped at 2 emails per hour, only reaches your team, and has no delivery guarantee. Supabase says it is for demos and testing. ### Do I need a separate provider for app emails and auth emails? No. One provider can do both. Auth emails go through the SMTP settings, app emails through the provider's API from a server function. Sources: [Supabase: custom SMTP](https://supabase.com/docs/guides/auth/auth-smtp); [Supabase: auth rate limits](https://supabase.com/docs/guides/auth/rate-limits); [Supabase: production checklist](https://supabase.com/docs/guides/deployment/going-into-prod). **Lovable guide** What Lovable builds, where it breaks and how to check it: [Lovable app rescue: what breaks and how to check it](https://whocanfixmyapp.com/guides/lovable). **Same category** - [My OpenAI key was in the frontend and I got a surprise bill](https://whocanfixmyapp.com/problems/openai-key-in-the-frontend-surprise-bill) - [OpenAI 429 rate limit errors in my app](https://whocanfixmyapp.com/problems/openai-429-rate-limit-errors) - [AI API costs are spiking](https://whocanfixmyapp.com/problems/ai-api-costs-are-spiking) - [Serverless or edge function timed out](https://whocanfixmyapp.com/problems/serverless-or-edge-function-timeout) - [Integration works locally but fails in production](https://whocanfixmyapp.com/problems/integration-works-locally-fails-in-production) [All ai apis and integrations problems](https://whocanfixmyapp.com/problems#ai-apis-and-integrations) **Run every check** The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.