Understanding Resend (Modern Developer Email API) Email Authentication
Resend is the developer-first email API for Next.js, Remix, and modern web applications. Resend enforces custom domain verification with strict SPF and DKIM authentication to ensure 100% inbox delivery and DMARC alignment.
When Resend (Modern Developer Email API) delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Resend (Modern Developer Email API)'s IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for Resend
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:resend.com ~all | 3600 | Authorizes Resend infrastructure. |
| TXT | resend._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkqhki... | 3600 | Resend 2048-bit DKIM signature key. |
| TXT | _dmarc | v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com | 3600 | DMARC anti-spoofing policy. |
Step-by-Step Setup Instructions
Log in to Resend Console > Domains > Add Domain.
Enter your apex domain (e.g. yourdomain.com) or dedicated sending subdomain (e.g. mail.yourdomain.com).
Copy the DKIM TXT record at "resend._domainkey" and add it to your DNS.
Add the SPF TXT record with "v=spf1 include:resend.com ~all".
Add the MX and feedback tracking records provided by Resend.
Click Verify DNS in Resend dashboard.
Common Resend SPF Configuration Mistakes
× MX Record Overwrite Risk
Cause: Publishing Resend MX records on an existing corporate email domain.
Fix: Use a sending subdomain (e.g. mail.yourdomain.com) if apex domain already has Google Workspace or M365.
Frequently Asked Questions
What is the SPF include string for Resend?
The SPF mechanism is "include:resend.com".
Should I use a subdomain for Resend?
Yes, using a subdomain (e.g. updates.yourdomain.com) isolates transactional reputation from corporate inbox MX records.
What DKIM record does Resend use?
Resend provides a 2048-bit RSA TXT DKIM record at resend._domainkey.yourdomain.com (or resend._domainkey.subdomain.yourdomain.com). The selector is "resend". This is a TXT record — not a CNAME — so the full public key is published directly in DNS.
Can Resend be used with Next.js and React Email?
Yes. Resend is purpose-built for Next.js, Remix, and React applications. The Resend SDK provides a React Email component library allowing you to build email templates using React components. Authentication (SPF/DKIM/DMARC) is configured once per domain and applies to all emails sent via the API.
What is the Resend MX record and when do I need it?
Resend provides an MX record pointing to feedback-smtp.us-east-1.amazonses.com for bounce and complaint processing. This is required for DMARC compliance if you use Resend's built-in bounce handling. If you set up Resend on a subdomain, the MX record goes on that subdomain.
Does Resend support DMARC strict alignment?
Yes. Resend supports strict DMARC alignment (aspf=s, adkim=s) since the resend._domainkey DKIM record is published directly under your exact sending domain, ensuring exact domain match rather than subdomain inheritance.