Resend

Resend's add-a-domain documentation lists DKIM and SPF records in the domain's Records tab. The set may be TXT and MX on a send subdomain or CNAME records for newer domains, and must match what Resend generated exactly.

Resend requires a verified domain before sending or receiving. Resend's troubleshooting article says records belong at the subdomain Resend shows, often send.example.com, and that proxied CNAME records can block verification.

Verification

Resend's docs say verification often completes within fifteen minutes but DNS propagation can take up to seventy-two hours. The dashboard highlights records that do not match the expected values.

DMARC and BIMI remain the domain owner's policies at _dmarc and BIMI names under RFC 7489 and the BIMI Internet-Draft cited on the What is BIMI page; Resend's domain table covers the records Resend requires for its own sending path.

Propagation

Resend's documentation cites fifteen minutes to seventy-two hours for DNS verification depending on propagation.

Older Resend domains may use TXT and MX on the send subdomain; newer domains may show CNAME records instead.

DMARC at _dmarc is still the domain owner's policy record when implementing RFC 7489 alongside Resend's required records.

What is SPF
SPF is a TXT record that starts with v=spf1. It lists the hosts allowed to send mail for the domain. Two records that both start with v=spf1 on the same name are a permerror.
What is DKIM
DKIM signs a message. The public key is a TXT record under _domainkey. The signature's s= tag is the selector and d= is the signing domain.
Amazon SES
Amazon SES uses a subdomain of amazonses.com as the default MAIL FROM. A custom MAIL FROM needs the SPF v=spf1 include:amazonses.com ~all and exactly one MX record.