Supabase password reset email not sending

What “not sending” usually means

The reset form can return success while no email shows up. Supabase Auth does that on purpose when the address is not a user, so the form cannot be used to discover accounts. If you are testing with an address that never signed up, nothing will arrive.

The built-in mailer that ships with a new Supabase project is only for early testing. It is rate limited, and mail from it often lands in spam. A production app needs your own SMTP (Resend, Postmark, Amazon SES, or similar) under Authentication → Emails.

Check these settings in order

Site URL. Authentication → URL configuration. The Site URL should be the origin people actually use, including https. A localhost Site URL in a deployed project will build reset links that never open the live app.

Redirect URLs. resetPasswordForEmail({ redirectTo }) must use a URL that is listed in the allow list. A wildcard such as https://your-app.com/** is allowed. An unlisted redirect is a common reason the message is skipped or the link errors after it arrives.

The email template. Authentication → Emails → Reset password. The template has to include the confirmation URL variable Supabase documents ({{ .ConfirmationURL }}). If that token was removed while editing the template, the message may fail to render.

Custom SMTP credentials. Host, port, username, and password need to match the provider. Port 465 is implicit TLS. Port 587 is STARTTLS. A wrong port looks like “nothing sent”. Send a test from the Supabase email settings page before you touch the app.

Auth logs. In the Supabase dashboard, the Auth logs show the mailer error (authentication failed, rate limit, invalid recipient). That line is more useful than the browser network tab, which often only shows a 200 from resetPasswordForEmail.

After the email exists

Open the link in the same browser where you requested it only if your app expects that. The page at redirectTo should call supabase.auth.verifyOtp or exchange the code, then updateUser({ password }). If the link opens and the page does nothing, the email did send. The bug is in the reset page, not the mailer.

Add the sender domain's SPF and DKIM before you blame the template. A new domain with no authentication is filtered even when Supabase says the message was accepted.