SPF record for Resend

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

SPF on Resend's return-path subdomain

Type: TXT · Host: send · 1 of 10 DNS lookups Copy

v=spf1 include:amazonses.com ~all

Also add an MX record on send: priority 10, value feedback-smtp.<region>.amazonses.com, with the region your domain uses.

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

Your main domain on Google Workspace stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com ~all

How SPF applies to Resend mail

Resend sends with a bounce (MAIL FROM) address on a subdomain set up for it, and receivers check SPF on that subdomain. Your main domain's SPF record doesn't need to change for Resend.

• With the CNAME setup, Resend shows one record on your return-path subdomain and one on an r-prefixed sibling, for example outbound and routbound; both must verify, or the domain shows as partially verified.
• A CNAME can't share a name with other records. If send already has records, pick another return path such as bounce when you add the domain.
• The MX record's region must match the domain's region in Resend, or verification fails with a region-mismatch error.

How to add it

1. In the Resend dashboard, open Domains, click Add Domain and enter the domain. Resend recommends a subdomain such as notifications.example.com.
2. Choose a region (us-east-1, eu-west-1, sa-east-1 or ap-northeast-1) and, under Advanced options, a custom Return-Path if you don't want send. It can't be changed later.
3. Copy the records from the Records tab: an MX and a TXT on the return-path subdomain (or two CNAMEs on newer domains) and the DKIM TXT on resend._domainkey.
4. Enter only send, not send.example.com, if your DNS host appends the domain, and don't proxy CNAMEs on Cloudflare.
5. Resend says domains often verify within 15 minutes but can take up to 72 hours. Then check the send subdomain with the SPF Checker below.

DKIM and DMARC alignment

Because the return path is a subdomain of your domain, SPF can align under DMARC's relaxed default, and the resend._domainkey TXT record lets Resend sign with your domain as well. Resend suggests adding DMARC once the domain is verified. See our Resend DKIM page.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Resend's include costs 1 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Resend's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding include:amazonses.com to your root SPF record. Resend checks SPF on the send subdomain, so the root include does nothing for Resend mail.
• Putting the MX and TXT records on the root domain. Resend's troubleshooting guide says they belong on the send subdomain.
• A doubled MX value such as feedback-smtp.eu-west-1.amazonses.com.example.com. Add a trailing period to the value if your DNS host appends the domain.