Symptoms
- Signup mail never arrives; Resend dashboard shows delivered, Gmail does not.
- Messages land in spam with “via amazonses.com” or a shared onboarding@resend.dev From.
- Resend, Domains shows the domain as not verified; DKIM still Pending.
- You added an SPF TXT and mail got worse — two SPF records on the same name.
Why Lovable / Bolt / v0 stop here
The generated server route calls Resend with an API key and a From the example used. That example is a shared domain. It is allowed for a demo. It is not a product. DNS is outside the repo, so the generator cannot finish the job. People ship, then wonder why nobody confirms their email.
The actual fix
- Pick a sending hostname. yourdomain.com if nothing else sends from it; mail.yourdomain.com if Google Workspace already owns the apex.
- Resend, Domains, Add. Copy the DKIM CNAME and the SPF TXT exactly. Do not “fix” the trailing dot. Do not invent an include.
- One SPF TXT per hostname. If Google Workspace also sends, merge includes into a single record. A second SPF TXT is a fail.
- Start DMARC in monitoring: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=s; Then tighten to p=quarantine and later p=reject after two weeks of reports.
- Change the From in code to an address on the verified domain. Set Reply-To to a box you actually read.
- Wait for the dashboard to say Verified before you send real mail. TTL of 3600 means testing at minute one is theatre.
SPF -all is correct once every sender is listed. ~all is how mail leaks into spam forever. Do not jump to DMARC reject on day one if billing tools still send from the same apex.
A longer sketch, including the Google Workspace merge, is kit/resend-dns.md. The $297 triage is this issue if the registrar UI is the blocker.