Supabase uses user email instead of sender email for custom smtp in some circumstances

Start with the Auth /recover entry point and the Custom SMTP settings flow described in the issue. Reproduce the recovery-email failure with SES, then inspect Auth logs to compare the configured sender email with the user email passed to the mail provider. Done means recovery emails consistently use the configured sender address and name.

• I confirm I have searched the Docs, GitHub Discussions, and Discord.
• I confirm this is a bug with Supabase, not with my own application.

Describe the bug

When one changes from the built-in Supabase email to using a Custom SMTP provider, Supabase may (under circumstances not determined) use the app user's email (e.g. john@doe.com) as the from address rather than using the specified "from" under Customer SMTP (e.g. admin@mydomain.com).

The event message for the error in Auth looks like this:

{"auth_event":{"action":"user_recovery_requested","actor_id":"f1f5ecf2-573d-497d-baef-6a8b1117ab71","actor_username":"john@doe.com","actor_via_sso":false,"log_type":"user"},"component":"api","error":"gomail: could not send email 1: 554 Message rejected: Email address is not verified. The following identities failed the check in region US-EAST-2: john@doe.com","level":"error","method":"POST","msg":"500: Error sending recovery email","path":"/recover","referer":"https://some-address.netlify.app/reset-password","remote_addr":"151.211.27.38","request_id":"91e4000b41d2bf77-ATL","time":"2025-03-10T15:56:06Z"}

The metadata looks like:

[
  {
    "host": "db-afimbptvoogkfkosrisw",
    "component": "api",
    "_SYSTEMD_CGROUP": null,
    "request_id": "91e4000b41d2bf77-ATL",
    "mail_from": null,
    "message": null,
    "_SOURCE_REALTIME_TIMESTAMP": null,
    "PRIORITY": null,
    "_AUDIT_LOGINUID": null,
    "panic": null,
    "metering": null,
    "UNIT": null,
    "event": null,
    "SYSLOG_FACILITY": null,
    "msg": "500: Error sending recovery email",
    "mail_type": null,
    "EXECUTABLE": null,
    "user_id": null,
    "_CMDLINE": null,
    "action": null,
    "auth_event": [
      {
        "action": "user_recovery_requested",
        "actor_id": "f1f5ecf2-573d-497d-baef-6a8b1117ab71",
        "actor_name": null,
        "actor_username": "john@doe.com",
        "actor_via_sso": false,
        "log_type": "user",
        "traits": []
      }
    ],
    "level": "error",
    "_PID": null,
    "path": "/recover",
    "duration": null,
    "_COMM": null,
    "header": null,
    "_MACHINE_ID": null,
    "login_method": null,
    "_STREAM_ID": null,
    "source_type": null,
    "_LINE_BREAK": null,
    "_EXE": null,
    "_AUDIT_SESSION": null,
    "_TRANSPORT": null,
    "x_forwarded_proto": null,
    "time": null,
    "mail_to": null,
    "_GID": null,
    "stack": null,
    "x_forwarded_host": null,
    "status": null,
    "_UID": null,
    "method": "POST",
    "CODE_FILE": null,
    "remote_addr": "151.210.97.34",
    "provider": null,
    "_SYSTEMD_UNIT": null,
    "issuer": null,
    "error": "gomail: could not send email 1: 554 Message rejected: Email address is not verified. The following identities failed the check in region US-EAST-2: john@doe.com",
    "client_id": null,
    "MESSAGE_ID": null,
    "referer": "https://some-address.netlify.app/reset-password",
    "_SYSTEMD_INVOCATION_ID": null,
    "CODE_FUNC": null,
    "_BOOT_ID": null,
    "INVOCATION_ID": null,
    "__MONOTONIC_TIMESTAMP": null,
    "timestamp": null,
    "__REALTIME_TIMESTAMP": null,
    "CODE_LINE": null,
    "_SYSTEMD_SLICE": null,
    "instance_id": null,
    "args": [],
    "SYSLOG_IDENTIFIER": null,
    "metadata": [],
    "_CAP_EFFECTIVE": null,
    "factor_id": null,
    "_SELINUX_CONTEXT": null,
    "project": null
  }
]

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Go to Authentication -> Emails -> SMTP Settings
2. Enable Custom SMTP
3. Enter sender email (e.g. admin@mydomain.com) and sender name (e.g. Admin Person)
4. Enter SMTP provider settings (in this case I'm using SES)
5. Click Save Changes.
6. Go to your app and click on the forgot password link
7. Enter your email
8. An error message will likely display saying it failed to send the message
9. Go to Logs -> Auth and you'll find an ERROR /recover | 500: Error sending recovery email message, it contains the info I shared above.

Expected behavior

After setting up Custom SMTP all emails sent via Supabase should use the Custom SMTP including using the sender email and sender name configurated under Custom SMTP.

System information

• OS: Windows 11
• Browser (if applies) Edge
• Version of supabase-js: 2.39.? and 2.49.1
• Version of Node.js: netlify's default