4mail.ing

Resend DNS Configuration Tutorial

How to Configure a Domain Name for Resend

Resend requires you to verify a domain you own before sending (and optionally receiving) email. This guide walks through the DNS records you need — DKIM, SPF, and receiving MX — using a real example configuration.

In short: add the domain in Resend → copy the DNS records from the Records tab → create them at your domain provider → wait for propagation → return to Resend to verify.

Before you start

You must use a domain you own. Shared or free addresses (Gmail, Yahoo, etc.) cannot be verified with Resend.

A domain you control

Access to DNS settings at your registrar or DNS host is required.

A Resend account

Open the Domains page in the Resend dashboard to add and verify domains.

15–30 minutes

Plus propagation time (often minutes, occasionally up to 72 hours).

Official docs: See Verified Domains and Add and verify a domain on Resend’s documentation.
Subdomain tip: Resend recommends sending from a subdomain (e.g. updates.example.com) instead of the root domain to isolate reputation and clarify intent to recipients.

Step 1 — Add the domain in Resend

  1. Open the Domains page

    In the Resend dashboard, go to Domains.

  2. Add your domain

    Click to add a domain and enter the name (root or subdomain). Example: projectread.com or mail.projectread.com.

  3. Open the Records tab

    Resend generates the exact DNS records for that domain. Copy them from the dashboard — do not invent values.

Step 2 — Required DNS records

For sending, Resend typically requires a DKIM record and SPF records (often an MX + a TXT on a subdomain such as send). If you enable receiving, an additional MX on the root (or chosen host) is required.

The tables below use the real values provided for projectread.com. Always copy the live values from your own Resend domain page.

DKIM (required for sending)

Type Name / Host Value TTL
TXT resend._domainkey p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCkgiNQBQyyapUWUYMRAjUVjS7Kmq+odM0/mXFXydo7+CqfV0Ven/1R9oh4Kam2Y1RER8JO12C4R9avz0A8KRMemzZ//EnjPSGmLAs+o0Go2NAnU5x6z3J8O+MgxJfICWzPYTqH4OENjbFQpy0o2x8Kg8SzFQNRa++iGSRjTJtdpwIDAQAB Auto

DKIM signs outgoing messages so receivers can verify they were authorized by the domain owner. Paste the full value without truncation or extra spaces.

SPF (required for sending)

Type Name / Host Value Priority TTL
MX send feedback-smtp.us-east-1.amazonses.com 10 Auto
TXT send v=spf1 include:amazonses.com ~all — Auto

SPF lists who is allowed to send mail for the domain. Resend often uses a dedicated host (here send) with both an MX (for feedback/bounces) and a TXT SPF policy. Both must match exactly for SPF to verify.

MX for receiving (optional)

Type Name / Host Value Priority TTL
MX @
(root / apex)		 inbound-smtp.us-east-1.amazonaws.com 0 Auto
Important: Adding an MX on the root domain routes inbound mail for @projectread.com to Resend/AWS. If you already use another mail provider (Google Workspace, Microsoft 365, etc.) on the same host, do not replace their MX records without a clear plan — you may break existing inbound email.
Newer domains: Resend may show CNAME records instead of separate MX + TXT for SPF on domains created after certain dates. Always follow the exact set shown in your Records tab.

Step 3 — How to add records at your provider

Labels differ by registrar, but the process is the same:

  1. Open DNS management

    Log in where DNS for the domain is hosted (Cloudflare, GoDaddy, Namecheap, Route 53, OVH, Aruba, etc.).

  2. Create each record from Resend

    • Select the correct Type (TXT, MX, or CNAME if shown).
    • Set Name / Host exactly (e.g. resend._domainkey, send, or @).
    • Paste the Value / Points to without extra quotes or truncation.
    • For MX records, set the Priority as shown (e.g. 10 or 0).
    • Leave TTL on Auto / default when possible.
    • Save each record.

  3. Cloudflare / proxy warning

    If you use Cloudflare, set relevant records to DNS only (grey cloud), not proxied. Proxying can prevent verification.

Common providers

Cloudflare GoDaddy Namecheap Amazon Route 53 Google / Squarespace OVH Aruba Other

Step 4 — Verify and wait for propagation

  1. Return to Resend

    Open the domain in the dashboard and run verification (or wait for automatic checks).

  2. Allow DNS propagation

    Successful setups often verify within 15 minutes. In some cases it can take up to 72 hours. You can use Resend’s tools or public DNS checkers to confirm records are visible.

  3. Restart verification if needed

    If records look correct but status stays pending after a long wait, use Restart verification in the Resend UI.

Quick checks (examples):
nslookup -type=TXT resend._domainkey.projectread.com
nslookup -type=TXT send.projectread.com
nslookup -type=MX send.projectread.com

Full example: projectread.com

Complete set of records as provided for this domain. Use only as a structural reference — always copy values from your Resend account for your own domain.

Purpose Type Name Value Priority
DKIM TXT resend._domainkey p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCkgiNQBQyyapUWUYMRAjUVjS7Kmq+odM0/mXFXydo7+CqfV0Ven/1R9oh4Kam2Y1RER8JO12C4R9avz0A8KRMemzZ//EnjPSGmLAs+o0Go2NAnU5x6z3J8O+MgxJfICWzPYTqH4OENjbFQpy0o2x8Kg8SzFQNRa++iGSRjTJtdpwIDAQAB —
SPF (feedback) MX send feedback-smtp.us-east-1.amazonses.com 10
SPF (policy) TXT send v=spf1 include:amazonses.com ~all —
Receiving MX @ inbound-smtp.us-east-1.amazonaws.com 0

Optional: DMARC

After the domain is verified, Resend recommends implementing DMARC to strengthen authentication and improve deliverability. A typical starting record is a TXT on _dmarc with a policy such as p=none while you monitor reports, then tightening later.

FAQ & troubleshooting

Domain still not verifying after hours

Confirm every record matches Resend exactly (full DKIM value, correct host names, correct MX priority). Check public DNS with lookup tools. On Cloudflare, disable proxy (orange cloud) for verification records. After fixing, use Restart verification in Resend if needed. Full propagation can take up to 72 hours in rare cases.

DKIM value is very long

That is normal. Copy the entire string. Do not truncate, do not add SPF text into the DKIM field, and avoid wrapping quotes unless your provider requires them for TXT.

I already have SPF on the root domain

Resend’s example uses SPF on the send host, which does not replace a root SPF. Keep existing root SPF if other systems need it, and still add the Resend-specific records exactly as shown.

Will the receiving MX break my current inbox?

Yes, if you point the same host that currently receives mail (often @) to Resend’s inbound MX, mail will go to Resend instead of your previous provider. Only enable receiving on a host you intend to use with Resend, or use a dedicated subdomain.

Resend shows CNAME records instead of MX + TXT

Newer domains may use CNAME-based SPF setup. Follow the Records tab for your domain; do not mix old and new styles.

Where are the official Resend docs?

Verified Domains · Add and verify a domain · Domain not verifying

Open official Resend guide

Need the domain prepared for you? Contact Ontiscal.