How to Verify a Sending Domain in Resend

What you're doing and why it's painful

Resend lets you send transactional email programmatically — password resets, receipts, notifications — from your own domain. Before Resend can send on your behalf, you need to verify that domain by adding DNS records that prove you own it.

The pain: domain verification requires adding 3-4 DNS records (SPF, DKIM, DMARC) with exact values Resend provides. The records must be DNS-only (not proxied), any typo in the DKIM key silently breaks delivery, and "verified" in Resend's dashboard doesn't mean emails are landing in inboxes — it just means DNS is configured correctly.

Prerequisites

• A Resend account (resend.com)
• Access to your domain's DNS settings (this guide shows Cloudflare, but the record values are the same for any provider)

Step 1 — Add your domain in Resend

1. Log in to Resend
2. Go to Domains in the left nav
3. Click Add Domain
4. Enter your domain — e.g. yourdomain.com
5. Select the region for sending (choose the one closest to your users)
6. Click Add

Resend shows you a table of DNS records to add. Keep this page open.

Step 2 — Add the SPF record

SPF tells other mail servers that Resend is authorised to send email from your domain.

Go to your DNS provider (e.g. Cloudflare → DNS → Records → Add record):

If you already have an SPF record, don't add a second one. Merge them:

v=spf1 include:_spf.resend.com include:existing-provider.com ~all

Step 3 — Add the DKIM record

DKIM cryptographically signs outgoing emails so recipients can verify they haven't been tampered with.

The DKIM record from Resend looks like:

Copy the full key from Resend — it's long, and it must be exact. Missing even one character breaks DKIM verification and your emails will fail authentication silently.

Step 4 — Add the DMARC record

DMARC defines what happens when SPF or DKIM fails. Start in monitor mode (p=none) — you can tighten it once you've confirmed everything is working.

Step 5 — Verify in Resend

Back in Resend, click Verify DNS records. Each record will show either ✅ (verified) or ❌ (not found / incorrect).

DNS propagation typically takes a few minutes but can take up to 24 hours. If records show as unverified, wait 15 minutes and try again before debugging.

Step 6 — Get your API key and send a test email

Once verified:

1. Go to API Keys → Create API key
2. Name it (e.g. Production) and set permissions to Sending access
3. Copy the key — it's only shown once
4. Add it to your environment as RESEND_API_KEY

Send a test email:

import { Resend } from 'resend';

const resend = new Resend(process.env.RESEND_API_KEY);

await resend.emails.send({
  from: '[email protected]',
  to: '[email protected]',
  subject: 'Test email from Resend',
  text: 'It works.',
});

Install the SDK: npm install resend

Checking your inbox placement

After sending, open the email in Gmail, click the three-dot menu → Show original. Look for:

SPF:   PASS
DKIM:  PASS
DMARC: PASS

All three passing = your domain is properly authenticated and emails should land in the inbox.

Common errors and gotchas

Domain shows as verified but emails go to spam Resend verified means DNS is correct — it doesn't guarantee inbox placement. Spam filters also evaluate content and sending reputation. A brand-new domain with no sending history will have low reputation. Warm up gradually: start by sending to people who expect your emails.

DKIM record showing as unverified after 24 hours Check the value was copied exactly. In Cloudflare, the record content should be on one line — Cloudflare handles long TXT record strings automatically. If your DNS provider has a 255-character limit per string, you may need to split the value (Resend's dashboard usually provides split instructions).

from address not matching verified domain Your from field must use the domain you verified — [email protected], not [email protected] (unless you verified the subdomain). A mismatch causes DMARC alignment failures.

Got API key, but getting 401 Unauthorized Make sure you're passing the key in the Authorization: Bearer <key> header, or using the Resend SDK which handles this for you. Also check the key has Sending access (not read-only).