> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mailofly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Supabase Go-Live Checklist

> Essential steps before launching Supabase Auth with Mailofly in production.

# Supabase Go-Live Checklist

Before opening your application to public traffic, ensure your Supabase and Mailofly email configuration is hardened for production.

***

## 1. Domain Verification

* [ ] Your domain has a green **Verified** status in Mailofly.
* [ ] Both DKIM and SPF records are active and passing in DNS.
* [ ] You have a root DMARC record configured (`v=DMARC1; p=none; ...`).

***

## 2. Match Sender Domain Exactly

* [ ] The **Sender Email** in Supabase matches your verified Mailofly domain:
  * Example: If you verified `auth.myapp.com`, use `no-reply@auth.myapp.com`.
  * Do not send from unverified addresses or mismatched domains.

***

## 3. Customize Email Templates

* [ ] Replace Supabase's default generic email copy with branded templates.
* [ ] Ensure all confirmation links point to your production URL (`https://myapp.com/auth/confirm`), not `localhost:3000`.
* [ ] Set token expiration times (default is 1 hour).

***

## 4. Rate Limiting and Anti-Abuse

* [ ] Configure Supabase auth rate limits to prevent brute-force sign-ups.
* [ ] Enable CAPTCHA (hCaptcha or Cloudflare Turnstile) on your registration form to prevent bots from generating fake sign-ups and spam bounces.


## Related topics

- [Supabase Quickstart](/guides/tutorials/supabase-quickstart.md)
- [Supabase](/smtp/supabase.md)
- [Go](/getting-started/go.md)
- [Introduction](/sending/introduction.md)
- [n8n Integration](/guides/tutorials/n8n-integration.md)