Emails going to spam after launch

A new domain has no reputation

The first messages from a domain you bought this week are easy to filter. That is expected. Authentication does not guarantee the inbox, but missing authentication almost guarantees spam or a silent drop.

Send from a domain you control. The default Supabase sender and a random “no-reply@gmail.com” SMTP login are both poor production setups. Use Resend, Postmark, SES, or your host's mailer, and verify the domain in that dashboard.

The three DNS records

SPF is a TXT record on the domain that lists who may send. One SPF record only. If your host and your mailer both add one, merge them. Two SPF records make both fail.

DKIM is a TXT record the provider gives you, usually under a name like resend._domainkey. It signs the body. If you edit the message after the provider signs it, the signature breaks. Don't.

DMARC is a TXT record on _dmarc. Start with p=none and a rua address so you receive reports, and move to p=quarantine once the reports show your real mail is aligned. Alignment means the visible From domain matches the domain SPF or DKIM authenticated.

What to change in the message

Use one From address. Switching between hello@ and notifications@ looks like a new sender every time. Put a real reply-to that you read.

The link in the button should be on the same domain as the site you just launched, not a shortener. A bare IP or a preview URL that changes every deploy will be scored as suspicious.

If you mail customers in the US, the CAN-SPAM Act expects a real postal address and a way to stop marketing mail. Transactional mail (password reset, receipt) is a different category from a newsletter. Don't mix them in one message.

Check the actual spam verdict with the provider's logs and a seed inbox you control, including Gmail's “Show original” authentication results. The lines you want are spf=pass, dkim=pass, dmarc=pass.