Supabase signup confirmation emails silently go to spam
confirmation email not receivedUsers sign up and never arrive. Supabase's default SMTP is shared, rate-limited and poorly reputed, so confirmation mail lands in spam or is dropped.
Symptom
Signups appear in the database as unconfirmed. Users say they never got the email. You test it yourself and it works, because your own address has already interacted with the sender.
Why it happens
Supabase ships a shared default SMTP sender intended for development, with a low rate limit and no reputation tied to your domain. Mail from it is widely filtered. This is an invisible failure - the app reports success, the database row exists, and nothing surfaces the drop. It is the clearest instance of the §2c pattern: the failures that hurt most are the ones that do not announce themselves.
Fix
Configure custom SMTP with a real sending provider and authenticate the domain (SPF, DKIM, DMARC). Verify by signing up with a fresh address on a different mail provider, not one that has already received mail from you.