# DKIM record for Resend URL: https://iblockspam.com/dkim/resend Last updated: 2026-11-03 Record type: TXT Selectors: resend Key managed by: Provider (you publish its key) Resend signs with the selector `resend`, so its DKIM record is a TXT record at `resend._domainkey` on the domain you add, with a `p=` public key Resend generates. The key is 1024-bit and can't be changed. SPF records go on a separate `send` return-path subdomain. Resend recommends adding a subdomain such as `updates.example.com`. ## DNS records - DKIM key (TXT, host resend._domainkey): `p=` - Return path SPF on the send subdomain (not DKIM) (TXT, host send): `v=spf1 include:amazonses.com ~all` Paired with an MX record on send: priority 10, feedback-smtp..amazonses.com. Domains created after August 2026 may show two CNAMEs here instead. - DMARC policy (Resend's starting example) (TXT, host _dmarc): `v=DMARC1; p=none; rua=mailto:dmarcreports@example.com;` Use an address you can receive reports at. Resend suggests quarantine or reject once mail passes. ## Set it up and turn on signing - In the Resend dashboard, open **Domains**, click **Add Domain**, enter the domain and choose a region. Set a custom Return-Path under Advanced options now if you need one. - From the **Records** tab, create the TXT record `resend._domainkey`, plus the SPF records for the return path. Paste only the label if your DNS host appends the domain. - Wait for verification. Resend says it often takes 15 minutes and can take up to 72 hours; after that, use **Restart verification**. - Once verified, add a DMARC record on `_dmarc`, then optionally turn on tracking or enforced TLS. ## DMARC alignment A verified domain signs with `d=` set to the domain you added, which aligns with a From address at that domain or, under relaxed alignment, its parent. Resend says a verified domain already passes SPF and DKIM, and its return path is a subdomain too, so DMARC can pass through either check. Each subdomain you send from must be added and verified on its own. ## Key length and rotation Resend signs with 1024-bit keys and doesn't support 2048-bit ones. It says you can't change the key length, and it doesn't rotate or regenerate keys on request: the key created when you add a domain stays with it, even if you delete the domain and add it again to the same team. Resend points to RFC 8301, which sets 1024 bits as the minimum. ## Common mistakes - **Extra quotes, spaces or a truncated value.** Resend lists these as the usual DKIM mismatches; paste the whole value as generated. - **SPF text in the DKIM record.** The `resend._domainkey` value holds only the key; SPF belongs on the `send` subdomain. - **Records in the wrong DNS zone.** If your domain's DNS is in several places, add them where the nameservers actually point. - **Deleting the domain to get a fresh key.** Resend keeps the same key when a domain is re-added to that team. **Q: What is Resend's DKIM selector?** `resend`. The record is a TXT record at `resend._domainkey` on the domain you added to Resend, for example `resend._domainkey.updates.example.com` for a subdomain. **Q: Does Resend support 2048-bit DKIM keys?** No. Resend signs with 1024-bit keys, says you can't change the key length, and asks teams with a 2048-bit compliance requirement to contact it. RFC 8301 sets 1024 bits as the minimum signers should use. **Q: Will deleting and re-adding my domain give me a new Resend DKIM key?** No. Resend says the key it creates when you add a domain stays with that domain, even after you delete and add it again to the same team, and it doesn't regenerate keys on request. Sources: - Resend Docs: Add and verify a domain: https://resend.com/docs/add-a-domain - Resend Docs: Verify your domain on Cloudflare: https://resend.com/docs/guides/dns/cloudflare - Resend Docs: Do you need 2048-bit DKIM?: https://resend.com/docs/knowledge-base/do-i-need-2048-dkim - Resend Docs: What if my domain is not verifying?: https://resend.com/docs/knowledge-base/what-if-my-domain-is-not-verifying - Resend Docs: Implementing DMARC: https://resend.com/docs/dashboard/domains/dmarc --- Source: iBlockSpam, https://iblockspam.com/dkim/resend (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt