I'm building a website with a user table for managing subscription plans. Authentication and confirmation emails are handled through Supabase, but after redirecting the email flow, the messages are being sent from my business email domain instead of the default service address. The confirmation emails are consistently landing in spam, even though I haven't sent spam or done any cold outreach from this domain. The domain is only about six weeks old, and I've already made some changes to the email template. What should I check or fix?
4 Answers
A domain that’s only around six weeks old usually has little or no sending reputation. Even with SPF, DKIM, and DMARC configured correctly, mail providers may be cautious until the domain builds a history of legitimate, low-volume messages. Keep the sending volume gradual and make sure authentication and alignment remain consistent.
Also verify how the messages are being delivered. If you’re sending through a relay or service other than a properly configured transactional provider, the provider’s IP reputation and sending practices can affect delivery. Microsoft-hosted business mailboxes in particular can be strict with new domains, so test with several providers and inspect the headers rather than relying only on the sending dashboard.
Check the links inside the confirmation email, not just the From address. If the button still points to a shared Supabase project domain instead of a custom authentication domain, filters may treat it as suspicious because that domain is used by many unrelated projects. The wording, layout, URLs, and images can also resemble phishing templates, so simplify the message and use links that clearly match your business domain.
Start by checking the raw headers of an email that landed in spam. In Gmail, use “Show original” and inspect the Authentication-Results section for SPF, DKIM, and DMARC individually. Also check alignment: the records can technically pass while DKIM signs with the provider’s domain instead of yours, causing DMARC alignment to fail. You may need to add the email provider’s CNAME records so messages are signed using your own domain.
The domain is new, and I’ve also changed the email template recently.