# Auth email and SMTP

> Configure a production SMTP provider for Supabase Auth and protect delivery reputation.

# Auth email and SMTP

Supabase's default mail service is intended for exploration. It sends only to authorized project-team addresses, has a low quota, and provides no delivery SLA. A public application using email signup, OTP, magic links, invitations, email changes, or password recovery needs custom SMTP.

Follow [Configure production email](../guides/hosted-setup/06-production-email.md) during first deployment. This page records the longer-term operating policy.

## Provider setup

Supabase accepts standard SMTP credentials. Brevo, Postmark, Resend, SendGrid, and Amazon SES are common choices; use the provider that matches the project's delivery, regional, and support requirements.

For Brevo, follow its current [Supabase SMTP configuration guide](https://help.brevo.com/hc/en-us/articles/7924908994450-Send-transactional-emails-using-Brevo-SMTP), then enter the generated credentials under **Supabase → Authentication → SMTP Settings**.

Use:

- a dedicated transactional subdomain such as `auth.example.com`;
- a recognizable sender such as `no-reply@auth.example.com`;
- production-specific SMTP credentials;
- SPF and DKIM records supplied by the provider; and
- a monitored DMARC policy.

Keep Auth mail separate from marketing broadcasts where practical. Do not store Supabase-hosted SMTP credentials in browser environment variables or commit them to the repository.

## Rate limits

After custom SMTP is enabled, Supabase initially applies a conservative hourly email limit. Set a sustainable project-wide limit under **Authentication → Rate Limits**.

Do not confuse:

- **Email OTP expiration**, which controls how long OTPs, magic links, confirmations, recovery links, email changes, and invitations remain valid;
- **per-user resend cooldown**, normally 60 seconds;
- **project-wide email quota**, shared by several email-producing operations; and
- **OTP endpoint quota**, which is configured separately.

The application resend timer must never be shorter than the hosted cooldown.

## Abuse and deliverability

Public email endpoints can be abused to exhaust quotas or damage sender reputation. Apply CAPTCHA or Turnstile where the threat model requires it, monitor the sending provider's suppression and complaint lists, and plan capacity increases before a launch spike.

Disable click tracking in Auth emails when it rewrites one-time links. Some mail security scanners also prefetch links; use OTP entry where link prefetching is common among the intended users.

Inspect real delivered headers periodically and confirm SPF, DKIM, and DMARC alignment. Test with recipients outside the Supabase organization—a successful message to a project owner can otherwise hide that the default mailer is still active.

## Template availability

New Free plan projects using Supabase's default SMTP cannot customize Auth email templates. Configure custom SMTP before installing the project's [transactional email templates](../Marketing-and-Analytics/email-templates/index.md).