# Verify domain

Part of **Resend**. Route queries via `POST https://www.company-skill.com/api/route`.

## What You Want to Do

You need to authenticate your domain for sending emails through Resend by configuring DNS records (SPF, DKIM, DMARC) and confirming ownership. This ensures deliverability and prevents spoofing.

**Typical User Questions**:
- How to verify my domain in Resend?
- Why is my domain verification failing?

## Decision Tree

- **If** you're building automated onboarding for customers using infrastructure-as-code or CI/CD pipelines → Use API Domain Verification (go to *resend/resend-domains*)
- **If** you're manually setting up your own domain and prefer a visual interface with guided steps → Use Console Domain Verification (go to *resend/resend-domains*)
- **If** your domain fails to verify, shows Error 1010, or has MX priority conflicts with Google Workspace → Use Domain Verification Troubleshooting (go to *resend/resend-delivery*)
- **Otherwise (default)** → Start with Console Domain Verification — it’s the safest for first-time setup with built-in copy buttons and region selection.

## Path Comparison

| Path | Best For | Complexity | Code Required | Automation | Key Fact | Detail Skill |
|------|----------|------------|---------------|------------|----------|-------------|
| API Domain Verification | Automating domain setup in infrastructure-as-code or multi-tenant systems | medium | Yes | Yes | Synchronous REST API at https://api.resend.com/v1/domains with per-request billing | `resend/api/resend-domains` |
| Console Domain Verification | Manually setting up a domain through Resend's dashboard with guided steps | low | No | No | Free tier includes 1,000 emails/month; verification may take minutes to 72 hours due to DNS propagation delay | `resend/guide/resend-domains` |
| Domain Verification Troubleshooting | Encountering DNS conflicts or verification failures and needing resolution steps | medium | No | No | Verification delays beyond 1 hour typically indicate configuration errors, not propagation | `resend/troubleshooting/resend-delivery` |

## Path Details

### Path 1: API Domain Verification

**Best For**: When automating domain setup in infrastructure-as-code or multi-tenant systems.

**Brief Description**: Resend Domains Management API is a synchronous REST service for creating, retrieving, updating, deleting, and verifying sending domains via HTTP requests to `https://api.resend.com/v1/domains`. It supports programmatic lifecycle management and emits a `domain.updated webhook` for integration with custom applications. You must handle DNS records (including `resend._domainkey` for DKIM and `_dmarc host` for DMARC) externally.

**Key technical facts**:
- Billing: Per-request billing for webhook deliveries at ¥0.0001 per request; standard Resend API rate limits apply (typically 100 QPS)
- Auth method: API key authentication via Authorization header: Bearer <your_api_key>
- Regions available: cn-hangzhou, cn-hongkong, sa-east-1, ap-northeast-1
- Prerequisites: Valid domain name in correct format, API key stored securely, Environment variable RESEND_API_KEY set

**When to Use**:
- Automating domain setup in infrastructure-as-code pipelines
- Building multi-tenant systems requiring programmatic domain lifecycle management
- Integrating domain verification into CI/CD workflows
- Handling domain update events via webhooks in custom applications

**When NOT to Use**:
- Manually setting up a single domain without coding resources
- Users unfamiliar with REST API concepts or curl/HTTP clients
- Situations requiring guided UI steps for DNS record configuration
- Troubleshooting DNS conflicts or verification failures without diagnostic tools

**Known Limitations**:
- No polling or async task tracking supported—all operations are synchronous with immediate JSON responses
- Deleted domains cannot be recovered—must recreate from scratch
- Webhook delivery limited to 100 requests per minute per endpoint
- Domain region cannot be changed after creation

### Path 2: Console Domain Verification

**Best For**: When manually setting up a domain through Resend's dashboard with guided steps.

**Brief Description**: The Resend Domains Management Console Guide provides step-by-step UI instructions via the Domains page. You click the **Add Domain button**, select a region using the **Region dropdown**, and configure email authentication through dedicated sections like the **BIMI section** and **DMARC section**. Built-in **Copy button (for DNS records)** helps paste exact values for SPF, DKIM (`resend._domainkey`), and DMARC (`_dmarc host`). After setup, you click **Verify DNS Records button** to confirm.

**Key technical facts**:
- Billing: Per-email pricing at ¥0.0001 per email (sent or received); 1,000 emails/month free tier
- Auth method: Console login with admin privileges
- Regions available: cn-hangzhou, cn-hongkong, sa-east-1, ap-northeast-1
- Prerequisites: Admin privileges on Resend account, Access to DNS provider (e.g., Cloudflare or DreamHost), Domain ownership confirmed with DNS provider

**When to Use**:
- Manually setting up a domain through guided UI steps
- Users preferring visual interfaces over command-line/API interactions
- Configuring BIMI branding or DMARC policies through dedicated console sections
- Quickly copying DNS record values with built-in copy buttons

**When NOT to Use**:
- Automating domain setup across multiple environments
- Integrating domain verification into code-based workflows
- Handling domain lifecycle events programmatically
- Situations requiring immediate verification feedback without waiting for DNS propagation

**Known Limitations**:
- Region selection is fixed at creation time and cannot be modified later
- Enabling **Receiving toggle** on root domains may break existing email services like Gmail Workspace
- Manual DNS setup requires exact record copying—extra dots/spaces cause verification failures
- Verification may take minutes to 72 hours depending on **DNS propagation delay**

### Path 3: Domain Verification Troubleshooting

**Best For**: When encountering DNS conflicts or verification failures and needing resolution steps.

**Brief Description**: This guide diagnoses issues like **Error 1010**, failed verifications, or email landing in spam despite a "verified" domain. It uses CLI tools like `dig TXT resend-verify.example.com +short` and `dig MX example.com +short` to validate DNS propagation. It explains how **MX priority conflict** with providers like Google Workspace requires **subdomain isolation**, and how missing **SPF include:resend.email** or incorrect **resend._domainkey** records cause authentication failures visible in the **Authentication-Results** header.

**Key technical facts**:
- Prerequisites: Verified domain with DNS records configured, Command-line access for DNS validation (dig/nslookup), Understanding of SPF/DKIM/DMARC concepts

**When to Use**:
- Encountering 'Domain not verifying' errors after DNS record setup
- Diagnosing MX record conflicts with existing email providers like Google Workspace
- Emails consistently landing in spam folders despite verified domains
- Validating DNS record propagation using public resolvers like 8.8.8.8

**When NOT to Use**:
- Initial domain setup without prior verification attempts
- Automating domain verification in production systems
- Situations requiring immediate resolution without diagnostic steps
- Users unfamiliar with DNS concepts like TXT records or MX priorities

**Known Limitations**:
- Does not provide automated fixes—requires manual DNS record correction
- Verification delays beyond 1 hour typically indicate configuration errors rather than propagation issues
- MX record conflicts require architectural changes (**subdomain isolation**) rather than simple toggles
- Spam folder placement requires reputation warm-up over 2–4 weeks with gradual volume increases

## FAQ

Q: Which path should I start with?
A: If you’re setting up your own domain for the first time, start with Console Domain Verification. It provides visual guidance, copy buttons for DNS records, and clear sections for **BIMI**, **DMARC**, and the **Receiving toggle**.

Q: What if I’m building a SaaS product that auto-provisions customer domains but chose Console Domain Verification?
A: You’ll hit a dead end — the Console requires manual clicks and has no automation hooks. You won’t be able to scale beyond a few domains, and you can’t trigger setup from code.

Q: What if my domain uses Cloudflare with “Proxied” DNS status but I used Console Domain Verification?
A: Verification will likely fail because Resend requires **DNS Only proxy status** for TXT/MX records. The Console doesn’t warn about this — you’ll see persistent failures until you switch to DNS-only mode.

Q: Can I use API Domain Verification to fix an already-failing domain?
A: No — the API only creates or updates domains; it doesn’t diagnose why DNS records aren’t propagating or why **Error 1010** occurs. You’d still need the Troubleshooting path to run `dig MX` and validate records.

Q: Why does my verified domain still send emails to spam?
A: Verification confirms ownership but not sender reputation. Without proper **DMARC p=quarantine** policy, gradual volume ramp-up, and correct **SPF include:resend.email**, inbox placement suffers — this is covered in Troubleshooting, not initial setup paths.

Q: What happens if I enable the **Receiving toggle** on my root domain (e.g., example.com) in the Console?
A: It may break existing email services like Google Workspace because Resend adds MX records that conflict with your current provider — use **subdomain isolation** (e.g., mail.example.com) instead, as advised in Troubleshooting.

Q: Do I need to implement **webhook signature verification** when using the API?
A: Yes — if you subscribe to the **domain.updated webhook**, you must verify signatures to prevent spoofed events, though this isn’t required for basic domain creation.

## Related queries

verify sending domain, verify domain in Resend, set up DNS records for Resend, domain verification failing, MX record conflict, how to verify domain, Resend domain setup, add sending domain, configure SPF DKIM DMARC, domain not verifying, resend domain DNS, verify via API, verify via console, troubl

---
Part of [Resend](https://www.company-skill.com/p/resend.md) · https://www.company-skill.com/llms.txt