Custom SMTP with Google Workspace

[ryan-eiv]

Hello,
I'm trying to set up a custom STMP for supabase auth with the Google Workspace STMP relay.

I've set up the google workspace gmail relay like this:

And I've set up my stmp on supabase like this:

(mygoogledomain.io is just a placeholder and that email account is a user inside Google Workspace)

However, I'm getting a 500 response from supabase when I call signIn():

{message: "The upstream server is timing out"}

Is there a way to view the logs and figure out what the issue is?

[libovness]

@ryan-eiv I'm experiencing the same. Did you figure this out?

[libovness]

@ry-propeller we have found that our emails are going to spam as well, even after switching to sendgrid. @FerasAloudah is this a known issue?

[FerasAloudah]

@libovness Hey, sorry for the late reply. We've been running into issues using SendGrid as well, we think this is related to our domain's reputation and should be fixed after a while. Asking your users to mark the email as not spam, could help speed this up for the time being.

[Verify21]

Hey guys, did any of you figure a workaround for preventing emails appearing in spam?

[libovness]

We did. I don't know if any of these were independently effective but for us using friendly HTML emails and following up with people who had auth emails land in their spam and encouraging them to report it as not spam seems to have done the trick. I think it's more of a brute force meatspace thing than a technical set up thing.

[vincelwt]

Also having all my signup emails going to spam with mailgun. Never had issues with my other mailgun domains previously. Will try setting gsuite smtp with an app password see if it works.

[libovness]

i managed to solve it by switching to sendgrid smtp google smtp stopped working for reasons that remain unknown

…

On Sun, May 8, 2022 at 11:08 Feras Aloudah ***@***.***> wrote: @libovness <https://github.com/libovness> did you manage to solve this issue? I managed to get rid of the timeout error by changing the SMTP port to 25. However, I'm now getting an "Error sending magic link" error. Any thoughts? Also, @ry-propeller <https://github.com/ry-propeller> how are you sending the magic links from your own backend? Are you self-hosting your Supabase instance? — Reply to this email directly, view it on GitHub <#5320 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEVUAVLSK7XVVQR7ECYZLLVI7KGXANCNFSM5NR5Z2PQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[FerasAloudah]

Thanks for the quick reply! I'll give SendGrid a look.

[benlammers]

If anyone else runs into this issue with Gmail SMTP I solved mine by using a Google App Password not my accounts default password. This solved it for me!
https://support.google.com/accounts/answer/185833

[benlammers]

I followed the instructions linked in my comment above to get an app password then I put the app password in for SMTP password in Supabase

[mfaywu]

Sadly it looks like app passwords are not supported by Google Workspace, I guess you can only use it with personal Gmail.

[alexbaramilis]

For me it worked with app password and Google Workspace.

[ffuyu]

App passwords can be used in Google Workspace too. You just need to enable 2FA.

[vaibhavmundra]

If you can't find the App Password setting in your Google Workspace account page, just do a search for it. It wasn't showing under the security settings in mine, but I found it via search.

[MrdotSpock]

@benlammers @ryan-eiv Did you end up using smtp-relay.gmail.com? For us, it works with smtp.google.com (thanks for the app password trick btw), but we can't make it work with relay. Do we need to change some other parameters?

[alexbaramilis]

And now it stopped working. I'm getting AuthRetryableFetchError. Switched to smtp.gmail.com and seems to be working so far.

[ArianSha]

Hey @alexbaramilis did you continue to use smtp.gmail.com without any issues?

[alexbaramilis]

Hi @ArianSha, I was away for a few weeks and didn't check it but I just tested it now and it's still working.

[ArianSha]

Thanks for checking. Have you had any issues with emails being recognized as spam? I have the same setup, and some of my sign up mails is recognized as spam on outlook. I found a seperate thread about it, but none of these tips were helpful.

#4858

[alexbaramilis]

None so far, but it's not in production yet and I'm only testing with my personal (hotmail) and org email (gmail). I've read that marking an email as not spam helps, so you could try getting a notice to your users to check their spam folders and if they find the email, mark it as not spam.

[hnykda]

Using app password worked for me!

[dr-starchildren]

Was this with the smtp-relay.gmail.com or just the smtp.gmail.com? I've not had consistent success with either.

[hnykda]

smtp.gmail.com

[kjendrzyca]

The only combination that works for me is smtp.gmail.com and port 587. Using anything else results in AuthRetryableFetchError and status code 504.

[MigotMateusz]

Same for me. smtp-relay.gmail.com does not work at all for me

[kangmingtay]

Hey @kjendrzyca, port 465 should work too with smtp.gmail.com. Hopefully this helps, but here is my SMTP configuration:

[libyandev]

it's work thank you

[kangmingtay]

Hey everyone, i've been hearing feedback about how challenging it can be to get google SMTP working properly with Supabase. I've tried setting this up with a trial google workspace account and this is what i've discovered.

1. The sender email and SMTP username has to be your google workspace admin email.
2. The SMTP password used has to be an app password. Google workspace doesn't make it easy to to figure out how to create this. You need to enable 2FA on your workspace account first (not inside the admin console but in https://myaccount.google.com/)
3. If you want to use smtp-relay.gmail.com only port 465 works. If you want to use smtp.gmail.com, you can use port 465 or 587 (both ports worked for me).

I'm also gonna include some screenshots below on what those steps look like:

For smtp-relay.gmail.com

(The "Require TLS encryption" option doesn't seem to affect anything during my testing)

For smtp.gmail.com

[kangmingtay]

How do I use the Google Workspace SMTP relay in Supabase to send emails from any email address within my domains associated with my Google Workspace account?

@mamiu hmm, that makes sense, but it sounds like more of question for Google Workspace because it seems like it depends on how you set up the routing rules

[mamiu]

@kangmingtay: This couldn't have been the issue, because the SMTP relay with the same credentials worked well everywhere else.

I've just tried all different combinations and interestingly all of them work well now for us without having changed anything in the codebase.

So, it's possible now to use the Google Workspace SMTP Relay with port 465 or 587 and a different sender email address than the one used for authentication.

It might have been fixed in the meantime.

EDIT:

Well, I was a bit quick to judge.

What we found out is that it works for some Google Workspace accounts but not for others.
I'll add the required permissions and how to grant them here tomorrow.

[griiettner]

I'm having the issue where my app is unable to register users, because has trouble to send confirmation email.

Do you mind sharing the setup you used to make the setup works? Thanks in advance.

[deblanco]

@alexbaramilis, I can confirm that your solution with a non-admin account is working for me too
Thanks!

[nberney]

A good video that helped me how to Generate App Password in Gmail/Google Workspace: https://www.youtube.com/watch?v=lSURGX0JHbA

[groksrc]

Just an FYI from someone who has been working with GCP a lot. When you make changes to the SMTP configuration in the admin console the user interface won't tell you this but it is SLOW to take effect, sometimes up to 15 minutes or longer. If you've made all of the changes you think are appropriate, my recommendation is to just wait -- grab some coffee or whatever and then come back to it. This is not the only thing in Google that works this way, but it can be incredibly frustrating if you don't know to expect this behavior.

[jmordkoff]

If you have a personal gmail account, then the outbound email will ALWAYS have the from field set to your primary email address.

But if you have an org, then you can set up an connection using smtp-relay.gmail.com, authenticate using your admin's email address and an app password and then you have flexibility on the from / replyto fields (based on the option you selected when you created the smtp-relay service in google as documented so well above), e.g. you can start using 'noreply@myorg.com' as the replyto address.

[mehdinathani]

I have free gmail account, can i use this?

[tamdao]

I follow this guide and got this error:

How can I fix this issue?

[ramijames]

If anyone is still encountering this (like I was) and needs some more clear directions, I put together a write-up of the solution here: https://www.ramijames.com/labs/supabase-email-authentication-with-google-workspace

It boils down to:

1. Use SMTP Host: smtp-relay.gmail.com
2. Use SMTP Port: 465
3. Have 2fa enabled
4. Generate and use an app password
5. Use your admin account to authenticate with the above