I'm building a website with a user table for managing subscription plans. Authentication and confirmation emails are handled through Supabase, but after redirecting the setup, the messages appear to come from my business email instead of the default service address. More importantly, the confirmation emails are landing in spam even though I haven't sent unsolicited messages or done any cold outreach from the domain. The domain is only about a month and a half old, and I've already changed the email template. What should I check?
4 Answers
A domain that’s only six weeks old may not have much sending reputation yet. Even correctly authenticated mail can be filtered while providers learn whether the domain is trustworthy. Send only expected transactional messages, keep the volume steady, and avoid sudden bursts. Some corporate Microsoft mail systems are especially cautious with new domains.
Review the email content as well: wording, formatting, images, tracking links, and the overall layout can all affect filtering. Keep the confirmation message simple, clearly explain why the recipient is receiving it, use links on your own domain where possible, and confirm that your sending relay has a good reputation. Authentication helps prove who sent the message, but it doesn’t guarantee inbox placement.
Check the confirmation link and other URLs inside the email, not just the From address. If the button still points to a shared service domain rather than a custom authentication domain, mail filters may treat it as suspicious because that domain is associated with many unrelated projects. A custom auth domain can help make the links more consistent with your sender domain.
Open a message that landed in spam and inspect its raw headers. In Gmail, use “Show original” and check the Authentication-Results section for SPF, DKIM, and DMARC, including the domains that actually passed. Having all three DNS records present isn’t always enough—DKIM or SPF can pass but still fail DMARC alignment if the message is authenticated with the provider’s domain instead of yours. Make sure the provider’s DNS records or CNAMEs are configured so the message authenticates as your own domain.
I checked the records and all three appear to pass, but I’ll verify which domains are being used in the headers and whether they’re aligned.
The domain is about a month and a half old, so reputation may be a major factor even though the setup is configured correctly.