SPF, DKIM and DMARC for Resend
Short answer: Resend mail passes Gmail, Yahoo and Microsoft checks when you turn on DKIM with your own domain
and publish a DMARC record at _dmarc (start with p=none). The exact records and clicks are below.
| SPF | — | Not needed on your root domain: SPF lives on the send subdomain, which Resend uses as the return-path, so SPF passes and aligns with your domain. Don't add include:amazonses.com to your root SPF record. |
|---|---|---|
| DKIM | CNAME / TXT | TXT record at resend._domainkey with the key Resend shows (it starts with p=MIG). Return-path: an MX record at send (priority 10, value like feedback-smtp.us-east-1.amazonses.com) plus a TXT record at send with v=spf1 include:amazonses.com ~all. Some accounts show a CNAME for the return-path instead: copy exactly what Resend lists. |
| DMARC | TXT at _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comStart with p=none and a
mailbox you read, or a free report address that turns the reports into a dashboard; build your own. |
Step by step
- In Resend open Domains → Add Domain, enter the domain you send from (Resend suggests a subdomain such as
updates.example.com) and pick the region. - Add every record from the domain's Records tab at your DNS host: the DKIM TXT and the two
sendrecords. - Wait for the check (often 15 minutes, up to 72 hours). Fixed a record? Click Restart verification.
- No DMARC record yet? Publish one at
_dmarcon your root domain withp=noneand watch the reports before enforcing.
Mistakes that break it
- Paste only
sendorresend._domainkeyin the host field: most panels add your domain themselves. - Keep the trailing dot on the MX value if your panel accepts it; some hosts otherwise append your domain to it.
- The MX region must match the region you picked in Resend, and a CNAME can't share the
sendname with other records: pick another return-path subdomain such asbounceif it clashes. - On Cloudflare, set any CNAME to DNS only (grey cloud): proxied records never verify.
Check that it worked
After the fix, keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.
Get it fixed on Fiverr
Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 19-page guide, checklist, 20+ providers.
Other setup guides
Google WorkspaceMicrosoft 365Zoho MailHostinger EmailTitan EmailGoDaddy email (Microsoft 365 and Professional Email)Namecheap Private EmailIONOS MailProton MailCloudflare Email RoutingMailchimpSendGridAmazon SESShopify EmailKlaviyoHubSpotBrevoMailgunPostmarkZendeskConstant ContactMailerLiteKit (ConvertKit)ActiveCampaignFreshdeskIntercomZoho CampaignsHelp ScoutSquarespace Email CampaignsMailjetCampaign MonitorSalesforce Account Engagement (Pardot)Wix Email Marketing (Ascend)GorgiasSparkPost