CheckoutAlarmWatch my app free

00 / guide

Supabase sign-up emails sent with Resend going to spam

You set up Resend as Supabase's SMTP server, so sign-up emails now reach real customers. But some land in spam. Here are the fixes Supabase and Resend list, in order.

01 / what CheckoutAlarm checks

a

What it would catch here

Nothing on this page. CheckoutAlarm never sees your email.

b

What it won't catch

It doesn't sign up, log in or read inboxes. It loads one page you pick and reads Stripe with a read-only key. If spam is costing you sign-ups, it won't tell you.

c

Plans

Free: 1 site, checked once a day. Pro: $19 a month, up to 3 sites checked hourly. You prove you own the site first. For Stripe we only take a restricted key with read access to Events, Webhook Endpoints and Charges. Full secret keys are refused. Compare plans

02 / prove the email is really from you

1

Verify your domain in Resend

Resend sets up SPF and DKIM for you when you verify your sending domain. Do this before you send from Supabase. Resend: avoid Gmail's spam folder Resend: send with Supabase SMTP

2

Add a DMARC record

Add a TXT record named _dmarc on your domain. Start with v=DMARC1; p=none; rua=mailto:you@yourdomain.com;. Once your mail passes, move to p=quarantine, then p=reject. Resend: implementing DMARC

3

Check one email

Send yourself a sign-up email, open the original message, and look for dmarc=pass in the headers. Resend: test to confirm passing

03 / make the domain look like yours

1

Send from your site's domain

Resend says to send from the same domain your website uses. Sending from @example.com while your site lives at example.net gives Gmail less to trust. Resend: legitimize your domain

2

Give Supabase Auth a custom domain

Auth emails link to your project's Auth server. Supabase says a custom domain lowers the chance of spam filtering caused by another project's bad reputation. Supabase: set up a custom domain

3

Keep auth and marketing apart

Supabase suggests a separate sending domain and From address for sign-in emails, for example no-reply@auth.example.com, and another for newsletters. Supabase: don't mix auth and marketing email

04 / write emails filters like

a

Short and plain

Supabase's list: no promotions, no taglines, few links and images, a short subject with few emojis, and no email signature. Don't describe what your app does in a sign-in email. Supabase says this matters more for AI, Web3 and crypto apps. Supabase: consistent branding and focused content

b

Change templates rarely

Supabase suggests one big template change over many small ones, and no A/B tests on auth emails. Supabase: additional best practices

c

Grow slowly

A new domain has no history. Resend suggests sending small amounts first and building up. Resend: establish sending patterns

d

Stop bots from signing up

Bots signing up fake addresses can hurt your sending name. Supabase calls CAPTCHA the most effective fix. Supabase: dealing with abuse

05 / questions

Does verifying my domain in Resend set up SPF and DKIM?
Yes. Resend says SPF and DKIM are set up when you verify your domain. DMARC is a separate TXT record you add yourself.
What DMARC record should I start with?
Resend suggests starting with p=none and a report address, for example v=DMARC1; p=none; rua=mailto:you@yourdomain.com; then moving to quarantine or reject once all your mail passes.
Why do my emails land in spam only for some people?
Mail providers judge each sender on its own history. A new domain has none. Resend suggests starting with low volume and building up.

06 / where CheckoutAlarm fits

CheckoutAlarm won't catch this. It never sees your email. For emails that don't arrive at all, see our email not arriving guide.

CheckoutAlarm is new. It only checks sites you prove you own. How to verify

Watch my app free

07 / sources

Docs checked on Oct 20, 2026.