Fix guide · updated 2026-11-07

Supabase: "Error sending confirmation email"

Error sending confirmation email · Email address not authorized

Sign-up worked every time while you were testing. Then real people try it and get Error sending confirmation email, or Email address not authorized, or the email simply never arrives. Nothing is wrong with your code. Supabase's built-in email was never meant for real users.

Why it happens

Supabase's built-in email service is for testing only, and it has two limits that hit the moment you launch:

• It only delivers to members of your Supabase team. Everyone else gets Email address not authorized.
• It sends about 2 emails per hour for the whole project, with no delivery guarantee. Supabase can change that number without notice. Past the limit, users see email rate limit exceeded.

You tested with your own address, which is on your team, so everything looked fine. If you already connected your own email provider and still see Error sending confirmation email, the provider refused the message: jump to step 5.

The fix: connect a real email provider

1. Pick a provider

Supabase's docs list Resend, Amazon SES, Postmark, Twilio SendGrid, ZeptoMail and Brevo. Several have free plans big enough for a new app. Resend and Postmark are the quickest to set up.

2. Verify your domain with the provider

The provider gives you a few DNS records (usually SPF and DKIM). Add them where your domain's DNS lives (Cloudflare, Namecheap, GoDaddy…) and wait for the provider to show the domain as verified. This step is what keeps your emails out of spam folders.

3. Enter the SMTP details in Supabase

Supabase dashboard → Authentication → SMTP Settings (under Emails) → enable custom SMTP and fill in:

• Host and port: from your provider (port 465 or 587)
• Username and password: the SMTP credentials your provider gives you (often an API key)
• Sender email: an address on the domain you verified, like [email protected]
• Sender name: your app's name

4. Raise the rate limit

Right after you save, Supabase starts you at 30 emails per hour. If you expect more sign-ups than that, go to Authentication → Rate Limits and raise it.

5. Test, and read the log if it fails

Sign up with an address that isn't on your team. If it still fails, Supabase → Logs (Auth) shows the exact answer from your provider. The usual causes:

• the sender address isn't on the verified domain,
• a wrong password or API key,
• a port that doesn't match the encryption (465 = SSL, 587 = STARTTLS),
• the domain isn't verified yet at the provider.

The shortcut, and why to avoid it

You can turn off Confirm email in Supabase's email provider settings so sign-ups no longer need an email at all. That's fine for a quick test, but on a live app it lets anyone sign up with fake addresses and leaves users with no way to reset a password. Connect a real provider instead. It takes about 15 minutes.

Still not arriving?

If emails send but land in spam, your domain records (SPF, DKIM, and ideally DMARC) need fixing. If the confirmation link sends people to localhost, see our guide on login redirects to localhost.