Send Supabase email through SMTP with Ackuna

Before you start

You need three things from Ackuna. Each takes a few minutes, except the review in step 2.

1. An Ackuna account. Create one for free; no card is needed.
2. A verified sending domain. Add the domain your app sends from (for example yourdomain.com) under SMTP Relay, Domains in the console and publish the SPF, DKIM and DMARC records it shows you. The console checks them for you. A new sending domain is also reviewed by our team before it can send; that is not instant, and until it is approved the relay answers 452.
3. An SMTP credential for that domain. Under SMTP Relay, Credentials, create one for the verified domain. You get a username (smtp_…) and a password (sc_…). The password is shown once, so paste it into Supabase straight away; if you lose it, rotate the credential.

The From address in Supabase must be on exactly that domain. A credential for yourdomain.com can send as [email protected], but not from a subdomain such as mail.yourdomain.com or from another domain.

Hosted Supabase: the dashboard settings

Open your project in the Supabase dashboard, go to Authentication, then the SMTP settings page, and switch on Enable custom SMTP. Fill in the fields like this:

The form has no separate encryption setting; the port is all you choose. Save the settings.

The same settings can be sent through the Supabase Management API (PATCH /v1/projects/{ref}/config/auth), following Supabase's own example:

{
  "external_email_enabled": true,
  "smtp_admin_email": "[email protected]",
  "smtp_host": "smtp.ackuna.com",
  "smtp_port": "587",
  "smtp_user": "YOUR_SMTP_USERNAME",
  "smtp_pass": "YOUR_SMTP_PASSWORD",
  "smtp_sender_name": "Your App Name"
}

Raise Supabase's own rate limit

Once custom SMTP is on, Supabase lets Auth send 30 messages an hour to start with. To change that, open Authentication, Rate Limits in the dashboard. That limit is Supabase's; Ackuna's own limits are listed further down.

Self-hosted Supabase: the .env file

In the Docker setup, the SMTP settings live in the .env file next to docker-compose.yml. The compose file passes them to the Auth container as GOTRUE_SMTP_* variables.

[email protected]
SMTP_HOST=smtp.ackuna.com
SMTP_PORT=587
SMTP_USER=YOUR_SMTP_USERNAME
SMTP_PASS=YOUR_SMTP_PASSWORD
SMTP_SENDER_NAME=Your App Name

If you run the Auth server (GoTrue) without that compose file, set the same values under the names the compose file maps them to: GOTRUE_SMTP_ADMIN_EMAIL, GOTRUE_SMTP_HOST, GOTRUE_SMTP_PORT, GOTRUE_SMTP_USER, GOTRUE_SMTP_PASS and GOTRUE_SMTP_SENDER_NAME. Then restart all services, as the Supabase docs say, so Auth reads the new values.

Send a test email

Supabase has no test button for SMTP. Trigger a real Auth email instead: sign up a test user from your app, or send a password reset or magic link to an address you can read. Then open SMTP Relay, Messages in the Ackuna console: the message is listed there with its state (sent, delivered, bounced), so you can see whether it left even before it reaches the inbox.

Common errors

Authentication failed (535)

The username or password is wrong, the credential was revoked, or its domain is no longer active. Copy both values again from the console, with no spaces around them. If you no longer have the password, rotate the credential and paste the new one.

TLS handshake error, "wrong version number" or a connection that hangs

The app is trying SSL/TLS on connect, which the relay does not offer. Use port 587 with STARTTLS: the connection starts in plain text and is upgraded before the login. If the connection times out instead, check that your host or firewall allows outgoing connections to port 587; some cloud providers block it on new servers until you ask them to lift the block.

Sender rejected (550)

The From address is not on the domain the credential was created for. Set the From address in Supabase to an address on that exact domain. The same code is used for a recipient on your suppression list, because an earlier message to them bounced or was marked as spam.

Temporarily rejected (452)

Either you have reached your daily or monthly limit, or the sending domain is still waiting for review. Both are temporary: a mail server retries later, and the console shows your usage. A message with more than 10 recipients is also refused with 452, and one over 10 MB with 552.

Mail that is accepted but lands in spam usually points at DNS, not SMTP. Run the Email DNS check on your domain, or the SPF, DKIM and DMARC checkers one by one.

Limits

• The Free plan includes 3,000 relay emails a month and 100 a day, 1 SMTP credential and 1 sending domain. Paid plans and their limits are on the pricing page.
• New accounts start on lower limits until Ackuna has reviewed them: at most 20 Agent Mail, 200 SMTP relay and 500 newsletter emails a day, whatever the plan allows. After the review the plan limits above apply.
• Each new sending domain is reviewed before it can send.
• One message can have up to 10 recipients and be up to 10 MB.
• While we deploy an update, port 587 stays open and the relay holds the mail it accepts, then sends it when the update is done. A login it cannot check during that time gets a temporary 451; a retry goes through once the update is done.