Resend SPF and DKIM setup

What you are setting up

Resend is a developer email API for transactional and marketing mail. To send from your domain you add it in the Resend dashboard and publish three DNS records: a DKIM TXT record on your domain, plus an MX record and an SPF TXT record on a send subdomain that carries the Return-Path for bounces. DKIM signs as your domain, and because the Return-Path is a subdomain of yours, SPF aligns too. The thing that trips people up is putting the SPF record on the root domain, where Resend never looks for it.

Publish SPF and DKIM

In the Resend dashboard, open Domains and click Add Domain. Enter your domain (Resend recommends a subdomain such as notifications.yourdomain.com to isolate your sending reputation), choose the region you send from, and Resend shows you the records to add. With the domain in North Virginia they look like this:

Type:     TXT     (DKIM)
Host:     resend._domainkey
Value:    p=MIGfMA0GCSq... (the key Resend shows you)

Type:     MX      (Return-Path)
Host:     send
Value:    feedback-smtp.us-east-1.amazonses.com
Priority: 10

Type:     TXT     (SPF)
Host:     send
Value:    v=spf1 include:amazonses.com ~all

The DKIM selector is always resend, and the key is unique to your domain, so copy it exactly; extra quotes, spaces, or a truncated value are the usual reasons the record fails to verify. The MX hostname depends on the region you picked: us-east-1 (North Virginia), eu-west-1 (Ireland), sa-east-1 (Sao Paulo), or ap-northeast-1 (Tokyo). If you added a subdomain in Resend, the hosts nest under it (send.notifications and resend._domainkey.notifications). Paste only the host portion; if your DNS provider appends your domain to the MX value, add a trailing dot to stop it. On Cloudflare, leave the records as DNS only, not proxied. Then click Verify DNS. A correct setup usually verifies within 15 minutes; Resend keeps rechecking for 72 hours before marking the domain failed.

Add DMARC

Standard _dmarc TXT record, nothing Resend-specific. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports show every legitimate source passing.

The Resend gotcha

The SPF record goes on the send subdomain, not your root domain. Resend sets the Return-Path to send.yourdomain.com by default (you can rename the subdomain under Advanced options when adding the domain, or via the custom_return_path API parameter), and mailbox providers check SPF against that Return-Path. So include:amazonses.com belongs in the TXT record at send, and adding it to your root SPF record does nothing for Resend except spend one of your ten DNS lookups. Because send.yourdomain.com is a subdomain of your From domain, SPF aligns under DMARC's default relaxed mode, and DKIM aligns on its own with d=yourdomain.com. The other trap is region: the MX hostname is region-specific and cannot be edited in place. To move regions you delete the domain, add it again with the new region, and update DNS to match.

Confirm it worked

• Verify in Resend. The domain should move from Pending to Verified once all three records resolve. A Temporary Failure means Resend could not see a record on its last check; fix it and use Restart verification.
• Send a test and read the headers. Send through Resend, open the message, and confirm the DKIM signature shows d=yourdomain.com with selector resend, and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Resend should appear as an aligned source passing both SPF and DKIM in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.