# SPF record for Resend URL: https://iblockspam.com/spf/resend Last updated: 2026-11-03 Include: include:amazonses.com Where it goes: Resend's return-path subdomain (send) DNS lookups: 1 of 10 Resend doesn't touch your root SPF record. Its SPF records go on a return-path subdomain, send by default: a TXT record v=spf1 include:amazonses.com ~all and an MX record pointing to feedback-smtp in your sending region, such as feedback-smtp.us-east-1.amazonses.com. Domains created after August 2026 may show CNAME records there instead. ## Example records - SPF on Resend's return-path subdomain (TXT, host send): `v=spf1 include:amazonses.com ~all` Also add an MX record on `send`: priority 10, value feedback-smtp..amazonses.com, with the region your domain uses. - Your main domain on Microsoft 365 stays as it is (TXT, host @): `v=spf1 include:spf.protection.outlook.com -all` - Your main domain on Google Workspace stays as it is (TXT, host @): `v=spf1 include:_spf.google.com ~all` ## Notes - With the CNAME setup, Resend shows one record on your return-path subdomain and one on an `r`-prefixed sibling, for example `outbound` and `routbound`; both must verify, or the domain shows as partially verified. - A CNAME can't share a name with other records. If `send` already has records, pick another return path such as `bounce` when you add the domain. - The MX record's region must match the domain's region in Resend, or verification fails with a region-mismatch error. ## How to add it - In the Resend dashboard, open **Domains**, click **Add Domain** and enter the domain. Resend recommends a subdomain such as `notifications.example.com`. - Choose a region (us-east-1, eu-west-1, sa-east-1 or ap-northeast-1) and, under Advanced options, a custom Return-Path if you don't want `send`. It can't be changed later. - Copy the records from the **Records** tab: an MX and a TXT on the return-path subdomain (or two CNAMEs on newer domains) and the DKIM TXT on `resend._domainkey`. - Enter only `send`, not `send.example.com`, if your DNS host appends the domain, and don't proxy CNAMEs on Cloudflare. - Resend says domains often verify within 15 minutes but can take up to 72 hours. Then check the `send` subdomain with the SPF Checker below. ## DKIM and DMARC Because the return path is a subdomain of your domain, SPF can align under DMARC's relaxed default, and the `resend._domainkey` TXT record lets Resend sign with your domain as well. Resend suggests adding DMARC once the domain is verified. See our [Resend DKIM page](https://iblockspam.com/dkim/resend). ## Common mistakes - Adding `include:amazonses.com` to your root SPF record. Resend checks SPF on the `send` subdomain, so the root include does nothing for Resend mail. - Putting the MX and TXT records on the root domain. Resend's troubleshooting guide says they belong on the `send` subdomain. - A doubled MX value such as `feedback-smtp.eu-west-1.amazonses.com.example.com`. Add a trailing period to the value if your DNS host appends the domain. **Q: Where does the Resend SPF record go?** On the return-path subdomain, `send` by default, so `send.example.com`. The TXT value is `v=spf1 include:amazonses.com ~all`, next to an MX record pointing to feedback-smtp in your region. Your root SPF record stays as it is. **Q: Why does my Resend domain show CNAME records instead of MX and TXT?** Resend says domains created after August 2026 may get CNAME records for sending instead of the MX and TXT pair. Add exactly what the Records tab shows; with CNAMEs, the region is handled by the Resend host they point to. **Q: Can I change Resend's return-path subdomain later?** No. Resend sets the Return-Path when the domain is created. To use a different subdomain, delete the domain, add it again with the new custom return path, and publish the new records. Sources: - Resend Docs: Add and verify a domain: https://resend.com/docs/add-a-domain - Resend Docs: Verify your domain on Cloudflare: https://resend.com/docs/guides/dns/cloudflare - Resend Docs: Configure a custom Return Path: https://resend.com/docs/dashboard/domains/custom-return-path - Resend Docs: What if my domain is not verifying?: https://resend.com/docs/knowledge-base/what-if-my-domain-is-not-verifying --- Source: iBlockSpam, https://iblockspam.com/spf/resend (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt