Records to publish
Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Resend account: copy it from Resend's setup screen, which shows the exact record.
| For | Type | Host | Value |
|---|---|---|---|
| DKIM | TXT | resend._domainkey.{domain} | p={public-key}Copy the full value from the domain's Records tab in Resend. |
| Bounces (MAIL FROM)Domains created before August 2026 | MX | send.{domain} | priority 10 · feedback-smtp.{region}.amazonses.com{region} is us-east-1, eu-west-1, sa-east-1 or ap-northeast-1; newer domains may show this pair too. |
| SPFDomains created before August 2026 | TXT | send.{domain} | v=spf1 include:amazonses.com ~allOn the Return-Path subdomain, not on your root domain. |
| Return pathSome domains created after August 2026 | CNAME | send.{domain} | {target shown in the Resend Records tab}Replaces the MX and TXT pair; it must be DNS only, not proxied, and no other record can share the name. |
| Return pathSome domains created after August 2026 | CNAME | rsend.{domain} | {target shown in the Resend Records tab}If only one of the two CNAMEs verifies, the domain is partially verified. |
| DMARC optional | TXT | _dmarc.{domain} | v=DMARC1; p=none; rua=mailto:{report-address}Resend suggests starting at p=none, then moving to quarantine and reject once all mail passes. |
SPF
Not at your root domain: SPF goes on the Return-Path subdomain send.{domain} (or your custom one), as v=spf1 include:amazonses.com ~all next to an MX record, or behind CNAMEs on some domains created after August 2026. Resend uses that Return-Path for SPF and DMARC alignment, so SPF aligns with a From address on {domain} under relaxed alignment.
DKIM
One TXT record at resend._domainkey.{domain} with a 1024-bit key; Resend doesn't support 2048-bit keys. Copy the full value from the domain's Records tab; the record is required even for a receive-only domain.
DMARC alignment
Both can align: SPF through the send.{domain} Return-Path under relaxed alignment, and DKIM through the resend._domainkey key published on your domain.
Common mistakes
- Put the SPF and MX records on the send subdomain, not the root; most DNS panels want just send and resend._domainkey as the name.
- A CNAME on send.{domain} can't coexist with other records on that name and must not be proxied (Cloudflare DNS only).
- The MX value contains the sending region, and an MX for another region gives a region-mismatch error.
- The Return-Path and region are fixed when the domain is created; changing either means deleting and re-adding the domain.
- Some DNS providers append your domain to the MX value (feedback-smtp...amazonses.com.example.com), so add a trailing dot.
- Resend stops trying to verify after 72 hours and keeps re-checking verified domains, so a record removed later sets the domain to temporary failure.
Check that it worked
DNS changes can take a few minutes to show. Then run the free checks, no account needed:
How EmailSecOps recognises Resend
A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:
- Default DKIM selectors: resend