Sign-in links and receipts landing in spam usually mean the sending domain isn't set up: no SPF, no DKIM signature, no DMARC record. Gmail and Yahoo now expect all three.
What you see
Magic links, password resets or receipts arrive in spam, or never arrive.
Why it happens
Mail providers check that a domain says which servers may send for it (SPF), that mail is signed (DKIM), and what to do with mail that fails (DMARC). Without them, your app's mail looks like spoofing.
How to fix it
- Add your domain in your email provider (Resend → Domains) and create the DNS records it lists: SPF and DKIM.
- Add a DMARC record: a TXT record at
_dmarc.yourdomain.com, e.g.v=DMARC1; p=none; rua=mailto:you@yourdomain.com. - Send from an address on that domain, and give replies somewhere to go (an MX record).
Or ask your AI tool to fix it
Paste this into Lovable, Bolt, v0, Replit or Cursor:
Make the app send all email from an address on my own domain, read from an EMAIL_FROM environment variable, through Resend, and list the DNS records I need to add.
The full page, with the request ready to copy, is at launchpad.axonscape.com/fix/app-emails-go-to-spam. I work on Launchpad by Axonscape, which runs a free launch check for apps built with AI tools: it finds this and the other things that break at launch, from a public GitHub repo or a .zip of the code, and keeps nothing.
