Setup guide

Resend: SPF, DKIM and DMARC

Resend sends from a send subdomain with its own MX and SPF records, and signs with a DKIM key at resend._domainkey.

By Ahmet Karaca · Updated October 13, 2026 · Checked against Resend documentation on October 13, 2026

DNS records to add

MXHostsend

10 feedback-smtp.<region>.amazonses.com

Replace the part in angle brackets with your own value before publishing.

Bounce handling for the send subdomain

TXTHostsend

v=spf1 include:amazonses.com ~all

SPF for the send subdomain

TXTHostresend._domainkey

<DKIM value from Resend → Domains>

DKIM signing key

Steps

In Resend open Domains → Add Domain and pick your region.
Publish the MX, SPF and DKIM records Resend shows, then click Verify DNS Records.

Common mistakes

An existing A, TXT or MX record on the send subdomain conflicts with Resend's records. Remove it, or configure a different Return-Path subdomain such as bounce.example.com.
Keeping MX records for several AWS regions on the send subdomain fails verification. Keep only the MX record for the region your domain is configured in.
The DKIM value at resend._domainkey fails verification if it gains extra quotes or spaces, is truncated, carries SPF text or isn't copied in full. Resend says it must match exactly what it generated.
Proxied CNAMEs on Cloudflare (orange cloud) don't resolve as CNAMEs, so Resend's verification never completes until they are set to DNS only.

Good to know

These records live on the send subdomain, so they don't touch your root SPF record.
If you use the one-click Cloudflare setup (Domain Connect), Resend publishes CNAME records on send and rsend that point to records it hosts (for example send.forge.rmta.net) instead of the MX and SPF TXT above. Both setups are valid; the DKIM TXT at resend._domainkey stays the same.
Resend's exact record set depends on your region and when your domain was added. Always follow exactly what the Resend dashboard shows for your domain rather than this example.

Frequently asked questions

When will Resend show my domain as verified?

Often within 15 minutes, but DNS changes can take up to 72 hours. If it still hasn't verified by then, use Restart verification in the dashboard.

Should I add my root domain or a subdomain to Resend?

Resend strongly recommends a subdomain such as notifications.example.com. You can add several subdomains under one root domain, but each one is verified separately.

Is send the only Return-Path subdomain Resend allows?

No. Resend lets you set a custom Return-Path subdomain instead of the default send subdomain.

What if another Resend team already added my domain?

You can claim the domain to transfer its ownership to your account.

Which Resend region should I pick?

Choose the region closest to most of your recipients.

Adding records at your DNS host

Check your setup

After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Resend documentation.

Check your Resend setup

Or open the SPF checker, DKIM checker or DMARC checker directly.