DKIM record for Resend

The DNS records

Copy every value from the domain's Records tab. If you add a subdomain to Resend, the names sit under it, for example resend._domainkey.updates.

DKIM key

Type: TXT · Host: resend._domainkey Copy

p=<public key from the Records tab>

Return path SPF on the send subdomain (not DKIM)

Type: TXT · Host: send Copy

v=spf1 include:amazonses.com ~all

Paired with an MX record on send: priority 10, feedback-smtp.<region>.amazonses.com. Domains created after August 2026 may show two CNAMEs here instead.

DMARC policy (Resend's starting example)

Type: TXT · Host: _dmarc Copy

v=DMARC1; p=none; rua=mailto:dmarcreports@example.com;

Use an address you can receive reports at. Resend suggests quarantine or reject once mail passes.

Set it up and turn on signing

1. In the Resend dashboard, open Domains, click Add Domain, enter the domain and choose a region. Set a custom Return-Path under Advanced options now if you need one.
2. From the Records tab, create the TXT record resend._domainkey, plus the SPF records for the return path. Paste only the label if your DNS host appends the domain.
3. Wait for verification. Resend says it often takes 15 minutes and can take up to 72 hours; after that, use Restart verification.
4. Once verified, add a DMARC record on _dmarc, then optionally turn on tracking or enforced TLS.

DMARC alignment

A verified domain signs with d= set to the domain you added, which aligns with a From address at that domain or, under relaxed alignment, its parent. Resend says a verified domain already passes SPF and DKIM, and its return path is a subdomain too, so DMARC can pass through either check. Each subdomain you send from must be added and verified on its own.

Key length and rotation

Resend signs with 1024-bit keys and doesn't support 2048-bit ones. It says you can't change the key length, and it doesn't rotate or regenerate keys on request: the key created when you add a domain stays with it, even if you delete the domain and add it again to the same team. Resend points to RFC 8301, which sets 1024 bits as the minimum.

Common mistakes

• Extra quotes, spaces or a truncated value. Resend lists these as the usual DKIM mismatches; paste the whole value as generated.
• SPF text in the DKIM record. The resend._domainkey value holds only the key; SPF belongs on the send subdomain.
• Records in the wrong DNS zone. If your domain's DNS is in several places, add them where the nameservers actually point.
• Deleting the domain to get a fresh key. Resend keeps the same key when a domain is re-added to that team.