Skip to content

Supabase Auth: connect a custom email sender (SMTP)

Issue #144. Written 2026-10-05.

Why

Supabase's own email sender is for testing only. Per the Supabase docs (https://supabase.com/docs/guides/auth/auth-smtp, read 2026-10-05):

  • It sends 2 emails per hour for the whole project (not per user).
  • It sends only to members of the Supabase organization's team. Any other address fails with "Email address not authorized". So a real stranger signing up may get no email at all, not just a slow one.

Once a custom sender (SMTP — the standard way one mail server hands mail to another) is saved, Supabase sends to every address, starting at a limit of 30 per hour, which you can raise under Rate Limits.

Current setup (done 2026-10-05)

  • Sender: Resend, domain contact.pcbgenerator.com (a subdomain, so sign-up mail is kept apart from the main domain's mail, as Supabase advises).
  • Supabase sender address: no-reply@contact.pcbgenerator.com, via smtp.resend.com:465, user resend, password = a Resend API key.
  • DNS records in Hostinger (checked live on ns1.dns-parking.com):
Type Name (as typed in Hostinger) Value
TXT resend._domainkey.contact p=MIGfMA0…wIDAQAB (full key from Resend)
CNAME rsend.contact rsend.forge.rmta.net
CNAME send.contact send.forge.rmta.net

Re-checked 2026-10-07 on Google's DNS (nslookup -type=TXT <name> 8.8.8.8, issue #166): - DKIM (the email's signature): resend._domainkey.contact.pcbgenerator.com answers with the key above. - SPF (which servers may send): send.contact.pcbgenerator.com follows the CNAME to send.forge.rmta.net, which answers v=spf1 ip4:52.3.252.119 ip4:44.222.39.36 ip4:199.249.231.0/24 ~all; its MX is feedback.forge.rmta.net. - DMARC (what Gmail should do when the checks fail): contact has no _dmarc record of its own, so it inherits the root's _dmarc.pcbgenerator.com = v=DMARC1; p=none (report-only, no report address). - So the DNS side is in place. It does not by itself explain the Spam result below.

  • Resend "Enable Receiving" is off — only sending is needed.
  • Test (2026-10-05, 10:40 PM local): sign-up with hakicebi+smtp2@gmail.com showed "Check your email to confirm your account!"; Resend → Emails listed "Confirm Your Signup" as delivered, from MagicON AI <no-reply@contact.pcbgenerator.com>. ⚠ Gmail put it in Spam (user-reported) — sending works, but new users may not see the email. Tracked as issue #166.
  • Re-test (2026-10-07, fresh +tag Gmail address, user-reported): the confirmation email landed in the Inbox. Nothing in the email setup was changed by the #166 session between the two tests. Why the 2026-10-05 email went to Spam is not verified. A new sender that had not yet built a reputation with Gmail would fit, but nothing proves it.

Order that worked: DNS records → click Verify in Resend (status was "not started" until then, and sign-ups failed with "Error sending confirmation email") → Resend API key with Sending access → Supabase SMTP switched on and saved. The key lives only in the Supabase Password field — not in .env.

Traps met on the way:

  • In Hostinger, DNS records live under Domains → pcbgenerator.com → DNS / Nameservers → DNS records, not under "Subdomains" (that page makes a website).
  • Paste every value with Resend's copy button. Resend's screen shortens long values with […]; typing the shortened text breaks verification.
  • The DKIM key is different for each Resend domain — never reuse one from another domain.

Was it set up before? (checked 2026-10-05, before the change)

Not verified. The live setting lives only in the Supabase dashboard, and I could not read it (the browser was not signed in to Supabase; I may not sign in for you). What the repo shows:

  • supabase/config.toml (local-dev config only) has the SMTP block commented out and email_sent = 2. This does not prove what the live project uses.
  • docs/guides/SENDGRID_SETUP.md sets up email for the backend on Render (welcome mails, admin alerts) through SMTP_* environment variables. It does not touch Supabase sign-up emails, which Supabase sends itself.
  • Indirect hint: the "email rate limit exceeded" error after about 4 test sign-ups fits the built-in 2-per-hour sender, not the 30-per-hour custom one.

Check it yourself in 10 seconds: Step 3 below. If "Enable Custom SMTP" is off, it is not set up.

Note on SendGrid

SendGrid's permanent free plan ended on 2025-05-27; new accounts get a 60-day trial, then paid plans (https://www.twilio.com/en-us/changelog/sendgrid-free-plan). SENDGRID_SETUP.md said "100 emails/day forever free" until 2026-10-06 (#163).

Step 1 — pick a sender and get its 4 values

Resend (free plan) Hostinger mailbox you already have
Free limit 100/day, 3,000/month, 1 domain (pricing) depends on your Hostinger mail plan — free plan 100/day, Business Starter 1,000/day (Hostinger limits); your plan: not verified
Host smtp.resend.com smtp.hostinger.com
Port 465 465
Username resend support@pcbgenerator.com
Password a Resend API key (starts re_) the mailbox password
Extra setup add DNS records for pcbgenerator.com in Hostinger (Resend shows them) none

Resend values from https://resend.com/docs/send-with-supabase-smtp. Hostinger values from docs/guides/HOSTINGER_EMAIL_SETUP.md:99.

If you pick Resend

  1. Sign up at https://resend.com.
  2. Domains → Add Domain → contact.pcbgenerator.com (what we used).
  3. Resend lists DNS records (SPF/DKIM — they prove to Gmail etc. that Resend may send for your domain). In Hostinger hPanel → Domains → pcbgenerator.com → DNS / Nameservers, add each record exactly as shown.
  4. Back in Resend, click Verify. Wait until it says Verified (minutes to hours).
  5. API Keys → Create API Key, permission "Sending access", domain pcbgenerator.com. Copy it — it is shown once.

Step 2 — open the Supabase SMTP page

Sign in at https://supabase.com/dashboard, open the project orjmlibnlzkyuauaysye, then left sidebar Authentication → Emails (under "Notifications") → tab SMTP Settings.

Direct link: https://supabase.com/dashboard/project/orjmlibnlzkyuauaysye/auth/smtp

Step 3 — fill it in

  1. Turn on Enable Custom SMTP.
  2. Sender email: no-reply@contact.pcbgenerator.com (Resend — must be on the domain verified in Resend) or support@pcbgenerator.com (Hostinger — must be the mailbox itself).
  3. Sender name: MagicON AI.
  4. Host / Port / Username / Password: the 4 values from Step 1.
  5. Leave "Minimum interval between emails" at its default.
  6. Click Save changes.

Never paste the password or API key into a chat or a repo file.

Step 4 — raise the hourly limit

Authentication → Rate Limits → "Rate limit for sending emails". It starts at 30/hour after Step 3. Set it no higher than your sender's own daily cap allows (for Resend's 100/day, 30/hour is already above it, so leave it). Click Save changes.

Step 5 — test

  1. Sign up on https://pcbgenerator.com with an address that is not on the Supabase team (e.g. a fresh +tag Gmail address).
  2. The email should arrive within a minute and the "From" should show your new sender. Check the spam folder too.
  3. If it fails: Supabase dashboard → Logs → Auth shows the SMTP error.