Why Are My Website Confirmation Emails Going to Spam?
Asked by
MellowPine42
I'm building a website with a user table for managing subscription plans. Authentication and confirmation emails are handled through Supabase, but after redirecting the email flow, the messages are being sent from my business email domain instead of the default service address. The confirmation emails are consistently landing in spam, even though I haven't sent spam or done any cold outreach from this domain. The domain is only about six weeks old, and I've already made some changes to the email template. What should I check or fix?
Answers
Start by checking the raw headers of an email that landed in spam. In Gmail, use “Show original” and inspect the Authentication-Results section for SPF, DKIM, and DMARC individually. Also check alignment: the records can technically pass while DKIM signs with the provider’s domain instead of yours, causing DMARC alignment to fail. You may need to add the email provider’s CNAME records so messages are signed using your own domain.
Reply to this answer
Check the links inside the confirmation email, not just the From address. If the button still points to a shared Supabase project domain instead of a custom authentication domain, filters may treat it as suspicious because that domain is used by many unrelated projects. The wording, layout, URLs, and images can also resemble phishing templates, so simplify the message and use links that clearly match your business domain.
Reply to this answer
Also verify how the messages are being delivered. If you’re sending through a relay or service other than a properly configured transactional provider, the provider’s IP reputation and sending practices can affect delivery. Microsoft-hosted business mailboxes in particular can be strict with new domains, so test with several providers and inspect the headers rather than relying only on the sending dashboard.
Reply to this answer
A domain that’s only around six weeks old usually has little or no sending reputation. Even with SPF, DKIM, and DMARC configured correctly, mail providers may be cautious until the domain builds a history of legitimate, low-volume messages. Keep the sending volume gradual and make sure authentication and alignment remain consistent.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowPine42: The domain is new, and I’ve also changed the email template recently.