Signup Emails That Actually Arrive

Users of my app aren't getting their Supabase Auth emails. Help me find out why, step by step. I'm a [SKILL LEVEL], so explain each check in plain English.

Tech stack: [TECH STACK]
Which email: [WHICH EMAIL]
Who doesn't get it: [WHO DOESN'T GET IT]
Have I set up custom SMTP? [CUSTOM SMTP]
What I see: [WHAT I SEE]

Please check these in order:
1. Am I still using Supabase's built-in email sender? Explain that without custom SMTP, Supabase only delivers to addresses that are members of my project's organization team, and other addresses fail with "Email address not authorized". Tell me where to check this in the dashboard.
2. Could I be hitting the email rate limit? The built-in sender allows very few emails per hour, and Supabase also limits how often the same user can request another email. Explain what a "429 Too Many Requests" error means here.
3. Is the email actually being sent? Show me how to find the matching events in my project's Auth logs (Logs, with the Auth log type selected) and what a failed send looks like.
4. Is email confirmation turned on for my project, and is my code calling the right function (signUp, signInWithOtp, resetPasswordForEmail)?
5. For password resets: remind me that Supabase doesn't send a reset email when no account exists for that address, but still returns no error.
6. Could the email be arriving but going to spam or a promotions tab? Tell me what to ask the user to check.

Then tell me the most likely cause, the exact fix, and how to confirm it worked. If you're not sure about a dashboard location, say so and point me to the Supabase docs page.

Help me read my Supabase Auth logs to find out what happened to one auth email.

When I tried: [WHEN I TRIED]
The address was: [TEST EMAIL ADDRESS DOMAIN] (I'm not sharing the full address)
Log entries I copied (with personal details removed): [WHAT I COPIED FROM THE LOGS]

Please:
1. Tell me how to open Logs in the Supabase dashboard, select the Auth log type, set the time range, and search the event messages.
2. Explain each log entry I pasted in plain English.
3. Tell me whether Supabase tried to send the email, refused it, or hit a limit.
4. If the log shows an SMTP error from my email service, explain what that error usually means and what to check in that service's dashboard.
5. Tell me the next step to fix it.

If the logs I pasted aren't enough to tell, say exactly what else to look for.

Help me set up custom SMTP for Supabase Auth so my signup, magic link, and password reset emails reach real users.

Email service: [EMAIL SERVICE]
My domain: [MY DOMAIN]
Sender address I want: [SENDER ADDRESS]
Sender name: [SENDER NAME]
Where my DNS is managed: [WHERE DNS IS MANAGED]

Please walk me through:
1. If I asked for help choosing: compare 2-3 services that support SMTP and work with Supabase, in plain English. Tell me to check their current pricing and free tiers on their own sites.
2. Setting up my sending domain in that service and adding the DNS records it gives me (I'll copy them from the service; explain what each one is for).
3. Finding the SMTP settings in that service: host, port, username, and password. Tell me which of these is a secret, and remind me to paste it only into the Supabase dashboard, never into chat or code.
4. Where to turn on custom SMTP in my Supabase project's Authentication settings, and which fields to fill in (sender email, sender name, host, port, username, password).
5. How to send one test (for example, a password reset to an address that's not on my Supabase team) and how to confirm it went through my email service.
6. What to do if the test fails: which error messages mean wrong credentials, wrong port, or an unverified domain.

If you're not sure about a setting name or location, say so and tell me which docs page to check.

I've set up custom SMTP for Supabase Auth. Help me set the right email rate limit for my project.

Expected signups: [EXPECTED SIGNUPS]
Email service: [EMAIL SERVICE]
What happens now: [WHAT HAPPENS NOW]

Please:
1. Explain in plain English that Supabase sets a low starting email limit after you switch on custom SMTP, to protect a brand-new sending setup, and that I can change it on the Rate Limits page in Authentication.
2. Help me estimate how many auth emails I send per hour (signups, magic links, resets, email changes), including a busy launch hour.
3. Suggest a limit with some headroom, and explain the trade-off: too low blocks real users, too high lets bots burn through my email service's quota and reputation.
4. Remind me to check my email service's own sending limits so the two match.
5. Tell me what users see when they hit the limit, and suggest a friendly message for my app to show instead of a raw error.
6. Suggest protections to add before raising the limit a lot, like CAPTCHA on the signup form.

My app's auth emails are landing in spam. Help me check my email authentication records in plain words.

Sending domain: [MY DOMAIN]
Email service: [EMAIL SERVICE]
Where my DNS is managed: [WHERE DNS IS MANAGED]
My current DNS records: [MY CURRENT DNS RECORDS]

Please:
1. Explain SPF, DKIM, and DMARC like I'm new to this: what each one proves and what happens when it's missing.
2. Compare my records with what my email service asks for, and list anything missing, duplicated, or wrong. (A domain should have only one SPF record.)
3. Tell me exactly which record to add or change, and where, at my DNS provider.
4. Suggest a gentle starting DMARC policy for a small app, and explain what it does.
5. Explain how long DNS changes can take and how to check that they're live.
6. Remind me to look for a "verified" status in my email service before testing again.

If any value depends on my email service, tell me to copy it from that service's dashboard instead of guessing.

Rewrite my Supabase Auth email templates so they look trustworthy and are less likely to be flagged as spam.

App name: [APP NAME]
Templates to rewrite: [WHICH TEMPLATES]
Current template: [PASTE THE CURRENT TEMPLATE]
Tone: [TONE]

Rules:
1. Keep every template variable that makes the email work, like {{ .ConfirmationURL }}, {{ .Token }}, or {{ .TokenHash }}, exactly as written. Tell me which ones each template needs.
2. Short, plain subject lines with no emojis, like "Confirm your email" or "Reset your password".
3. One clear button or link, and as few other links and images as possible.
4. No marketing, taglines, or promotions, and don't describe what my app is in detail.
5. Explain why the email was sent and what to do if the person didn't ask for it.
6. Simple HTML that works in most email clients.

Then tell me where to paste each template in the Supabase dashboard (Email Templates), and remind me to send myself a test after saving.

Help me test my Supabase Auth emails before launch, carefully, so I don't damage my new sending domain.

Email service: [EMAIL SERVICE]
Test inboxes I own: [TEST INBOXES]
Emails to test: [WHICH EMAILS]

Please give me a short test plan:
1. Send each email type once to each test inbox. Keep the total small, because lots of test emails from a new domain can look suspicious.
2. For each one, record: did it arrive, which folder it landed in, and how long it took.
3. Show me how to open the full message headers in common mail apps and check whether SPF, DKIM, and DMARC passed. Tell me what "pass" and "fail" look like.
4. Click each link once and confirm it lands on the right page of my live app.
5. Check my email service's dashboard for each send: delivered, bounced, or rejected.
6. If anything fails, tell me which prompt or setting to look at next.

Only use addresses I own. Never test with made-up addresses, because bounces hurt deliverability.

Users click the link in my Supabase Auth email and get "Token has expired or is invalid". Help me find out why and fix it.

Tech stack: [TECH STACK]
Which email: [WHICH EMAIL]
Who sees the error: [WHO SEES THE ERROR]
My template and the page the link opens: [PASTE THE TEMPLATE AND THE PAGE THE LINK OPENS]

Please check:
1. Link prefetching: some email security tools open links in incoming emails to scan them, which can use up a one-time link before the person clicks. Explain how to tell if this is happening.
2. Whether my email service's link tracking is rewriting the link.
3. Whether the person clicked an older email after requesting a newer one, or waited too long.
4. Whether my app's confirm page handles the link the way my setup expects.

Then give me the fix that fits my app, explained simply. Supabase's docs describe options such as sending a one-time code ({{ .Token }}) that the user types in, or linking to a page with a button that completes the confirmation. Show me the template change and the code change, and tell me what to test afterward.

My Supabase password reset flow is broken. Help me trace it step by step and fix the broken part.

Tech stack: [TECH STACK]
Live site: [MY LIVE URL]
Page where users should set a new password: [MY RESET PAGE]
What happens: [WHAT HAPPENS]
Relevant files: [PASTE OR TAG THE RESET-RELATED FILES]

Please check each step:
1. The request: does my code call resetPasswordForEmail with a redirectTo that points to my reset page?
2. The allow list: is that exact URL allowed in my Supabase Redirect URLs, and is my Site URL set to my live site instead of localhost?
3. The template: if I pass redirectTo, does my reset template use {{ .RedirectTo }} where it needs to, instead of only {{ .SiteURL }}?
4. The landing: when the user arrives, does my app create the session correctly for my setup (client-only or server-side)? Explain which flow I'm using.
5. The update: does the reset page call updateUser with the new password once the user has a session, and show a clear success or error message?
6. Edge cases: an expired link, a reused link, or a reset requested for an address with no account.

Show me the smallest code or settings change for the broken step, then a short test plan using a real address I own.