Why is my Resend domain not verifying, and which DNS record is wrong?

By Ohad Krispin, founder of VibeRaven · LinkedIn

A Resend domain that will not verify usually has a DNS problem, and Resend's troubleshooting guide lists the causes: records added at a provider that does not control your nameservers, proxied CNAME records (Cloudflare), a CNAME that shares a subdomain with another record, a DNS host that appends your domain to the value, a DKIM value with extra quotes or spaces, or MX records in different regions. Resend says domains often verify within 15 minutes and DNS can take up to 72 hours. Until it shows as verified, sends from it fail with 403 "The example.com domain is not verified. Please, add and verify your domain."

Which DNS records does Resend need, and where do they go on Vercel?

Resend's guide for Vercel DNS lists an MX record and a TXT record on the send name for SPF and a TXT record on resend._domainkey for DKIM, or the Auto Configure button on the Domains page, which uses Domain Connect. The guide says to leave your own domain out of the record name when you paste, so you paste send and not send.example.com. The Records tab of your domain is the source of truth: the add-a-domain guide says the values must match exactly what Resend generated.

Type  Name               Value
MX    send               from the Records tab (priority 10)
TXT   send               from the Records tab (SPF)
TXT   resend._domainkey  from the Records tab (DKIM)

Why does the domain stay pending after I added the records?

Work through the causes in Resend's guide in this order. First find out who controls DNS: run a nameserver lookup with dns.email, and add the records there, because a domain can be registered in one place and served from Vercel or Cloudflare. Then check that records sit on the send subdomain and match Resend's values, with no added quotes or spaces in the DKIM value. If your DNS host appends your domain to a value, add a period at the end of the value. A CNAME cannot share a subdomain with an A, TXT or MX record, so move the Return-Path to another subdomain such as bounce.example.com if one already exists. In Cloudflare, set CNAME records to DNS only.

To see what the world sees, run the lookups Resend lists, with your own domain:

nslookup -type=TXT resend._domainkey.example.com
nslookup -type=TXT send.example.com
nslookup -type=MX send.example.com

The domain is verified and I still get "The domain is not verified"

The error names the domain in the from address. It must be the domain you verified, subdomain included: Resend's mismatch guide gives a verified sending.domain.com that fails for a from address on domain.com. Change the from address, or verify the domain you really send from. The related error for the shared test sender is covered in the testing emails error.

Checklist

How to fix it, then check the fix

01Open your domain in the Resend dashboard and look for red wavy underlines: they mark the DNS records with errors.
02Run a nameserver lookup with dns.email and confirm you added the records at the provider that controls the domain.
03
Compare the records Resend shows with what DNS returns, using your own domain:
```
nslookup -type=TXT resend._domainkey.example.com
```
04Fix the cause: copy values again without extra quotes or spaces, turn off Cloudflare proxying on CNAME records, and remove records that conflict with a CNAME on the same subdomain.
05Click Restart verification in the dashboard. Resend says DNS changes can take up to 72 hours, and that dns.email can confirm the records are public if it still fails after 24 hours.
06When the domain shows as verified, send from an address on that exact domain and check the response has data with an id and error set to null.

Sources

Official docs behind this checklist

Browse all launch guides · Read resources · How to make and check your next change

FAQ

FAQ for builders before launch

How long does Resend domain verification take?

Resend says domains often verify within 15 minutes of adding the records, and that DNS changes can take up to 72 hours to propagate. The dashboard has a Restart verification button to run a fresh check.

Do I need a DMARC record before the domain verifies?

The Resend docs add DMARC after verification and do not say it is needed for a domain to verify. They say to first make sure your emails pass SPF and DKIM.

What does partially_verified mean?

Resend's guide says it appears when a domain has two CNAME records and only one verifies. You can still send, but without a fallback sending server.