FixLoop

The Fix Loop #3: Supabase signup emails that never arrive

October 21, 2026

Hey. This week's most common breakage is a sneaky one, because it passes every test you run yourself.

What broke this week

From our X replies and help threads, four patterns kept showing up:

1. Signup confirm emails never reach real users. You test with your own email, it works, you launch, and strangers never get the link. More below.
2. "Saved!" and then the data is gone on refresh. An RLS policy filters the UPDATE down to 0 rows, and Supabase doesn't call that an error. Add .select() to the update and check that a row actually came back. Full guide
3. RLS policies written, RLS never turned on. The policies exist, but the table is still open. The Security Advisor in the Supabase dashboard flags this; check it after every migration.
4. Works on localhost, breaks in production. Still the classic: VITE_ variables are baked in at build time, so changing them means a redeploy, and the Supabase Site URL is often still localhost or the preview link. Guide

Fix walkthrough: signup emails that only reach you

Supabase gives every project a built-in email sender so you can get started. Per the Supabase SMTP docs, it only delivers to addresses on your project's team. Everyone else fails with "Email address not authorized", and it's capped at a few messages an hour. That's why it works perfectly when you test it.

The fix takes about 15 minutes:

1. Pick an email provider with SMTP (the docs list Resend, Postmark, AWS SES, SendGrid, Brevo and ZeptoMail). Verify your domain there and add the SPF and DKIM records it gives you.
2. In Supabase, open Authentication, find the SMTP settings, turn on custom SMTP, and paste the host, port, username and password. Use a From address like no-reply@yourdomain.com.
3. Check Auth rate limits. After you switch, Supabase starts you at 30 emails an hour; raise it if you're expecting a launch spike.
4. Test with an address that is not on your Supabase team, ideally a friend's Gmail. Check spam too.
5. Don't "fix" it by turning off email confirmation. The docs specifically warn against that, since it lets people create accounts in someone else's name.

Bonus: if bots start mass-signing-up, turn on CAPTCHA for Auth before your sending reputation takes the hit.

Tool worth trying: the Supabase MCP server, read-only

If your AI agent keeps guessing about your database, give it the real thing. The Supabase MCP server connects Cursor, Claude Code, Codex and others to your project so the agent can list tables, read policies and run the security advisors instead of inventing them.

Set it up the safe way: add ?project_ref=YOUR_REF&read_only=true to the server URL so it's locked to one project and can only read. Keep tool-call approval on, and never point it at production data you wouldn't paste into a chat.