Resend

Resend is a modern, developer-first email API with a clean dashboard and quick domain setup. It is a great fit for new projects that want transactional email running in minutes.

Choose Resend when you start a new project, like simple tooling and send low to medium transactional volume. Its free tier is small but enough for most contact forms. For very high volume at the lowest price look at Amazon SES; for EU-hosted marketing plus transactional, Brevo or Mailjet. See the services overview.

Prerequisites

• A Resend account.
• A verified domain (Domains → Add domain). Without one you can only send test emails from onboarding@resend.dev to your own account address – see Sandbox & limits.
• An API key with “Sending access” (not “Full access”): API Keys → Create API key → Permission: Sending access, optionally restricted to a single domain. This is the minimal permission Frontmail needs. Test connection recognises a sending-only key and accepts it.

Connect in Frontmail

1. Open Email services → Add service → Resend.
2. Fill in the fields:

Field	Where to find it	Example
API key	API Keys (shown only once)	re_123abc456def…
Webhook signing secret	Webhooks → your endpoint → Signing secret	whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Max emails per second	Optional; default 2/s (Resend’s default team limit)	2

3. Click Verify & save.
4. The service is saved once the check passes. Credentials are encrypted with AWS KMS envelope encryption.

DNS: SPF, DKIM and DMARC

Resend shows the records on the domain page. For example.com they look like:

; DKIM
resend._domainkey.example.com.  TXT  "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ…"

; SPF + bounce handling on the "send" subdomain (the envelope sender)
send.example.com.               MX   10 feedback-smtp.us-east-1.amazonses.com.
send.example.com.               TXT  "v=spf1 include:amazonses.com ~all"

; DMARC (recommended by Resend, not created automatically)
_dmarc.example.com.             TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

• The send subdomain carries SPF, so you do not have to touch your root domain’s SPF record.
• The MX host contains the region you picked for the domain (us-east-1, eu-west-1, …).
• Some DNS providers append the domain automatically – enter resend._domainkey and send as the host names, not the full names.
• Start DMARC at p=none, then tighten to p=quarantine / p=reject.

Note

Gmail and Yahoo’s 2024 requirements (SPF/DKIM alignment, DMARC, one-click unsubscribe for marketing, low spam rate) are covered for transactional mail by the records above.

Regions

When adding a domain, Resend lets you choose its sending region – e.g. North Virginia (us-east-1), Ireland (eu-west-1), São Paulo (sa-east-1) or Tokyo (ap-northeast-1). The API endpoint (api.resend.com) is the same for all regions, so there is no region field in Frontmail; the region is a property of the domain. To change it, add the domain again with the new region and update DNS.

Sandbox & limits

• Without a verified domain you can send only from onboarding@resend.dev and only to the email address of your Resend account. Anything else fails with 403 – You can only send testing emails to your own email address, which Frontmail treats as an auth error.
• Free plan: 3,000 emails per month, 100 per day, 1 domain.
• Rate limit: 2 requests per second per team by default; Frontmail’s default for Resend is therefore 2/s. Resend can raise it on request.
• Exceeding the daily or monthly quota returns 429 daily_quota_exceeded / monthly_quota_exceeded; retries won’t help until the quota resets, so such messages usually end as failed with the credit refunded.

Webhooks (delivery tracking)

1. Copy the webhook URL from the service page in Frontmail (copy button):

   https://api.frontmail.dev/webhooks/providers/resend/<token>

2. In Resend open Webhooks → Add endpoint, paste the URL and select the events:

Resend event	Frontmail event
email.delivered	delivered
email.bounced (Permanent)	bounced – added to the suppression list
email.bounced (Transient / other)	recorded as a soft bounce
email.delivery_delayed	recorded on the message
email.complained	complained – added to the suppression list
email.opened	opened (enable open tracking on the domain)
email.clicked	clicked (enable click tracking on the domain)

3. Open the endpoint, copy the Signing secret (whsec_…) and paste it into the Frontmail field Webhook signing secret.

Signature verification: Resend delivers webhooks through Svix. Frontmail checks the svix-id, svix-timestamp and svix-signature headers: HMAC-SHA256 of id.timestamp.body with your signing secret, and rejects requests with a timestamp more than 5 minutes off. Without the secret, events are not verified and are ignored.

Frontmail adds a tag with its message ID to every email so events can be matched.

Common errors

• auth – the service is broken (invalid or deleted key, unverified domain, test-mode restrictions, 401/403). The service is marked unhealthy; the owner gets an email and a dashboard banner. A fallback service on the template takes over; otherwise the credit is refunded and the message waits in the hold queue as held_service_error, sent automatically after you fix the service (re-checked on save and by the daily health check).
• permanent – this message can’t be sent (invalid recipient, 422 validation). Fallback service if configured, otherwise failed and refunded.
• transient – 5xx, 429, timeouts. Retried with exponential backoff; after the last attempt failed and refunded.

Resend response	Class	What to do
401 missing_api_key / 403 invalid_api_key	auth	Create a new Sending access key and update the service.
403 validation_error – The example.com domain is not verified	auth	Finish domain verification in Resend, or fix the From domain in the template.
403 validation_error – You can only send testing emails to your own email address	auth	Verify your own domain; the resend.dev test sender is only for your own inbox.
422 validation_error – Invalid to field	permanent	See invalid recipient.
422 invalid_attachment / 422 validation_error (other fields)	permanent	Fix the template or attachment; see HTML templates.
429 rate_limit_exceeded	transient	Too many requests per second; keep Max emails per second at 2 or ask Resend for more.
429 daily_quota_exceeded / monthly_quota_exceeded	transient	Quota used up; upgrade the plan.
500 internal_server_error, timeout	transient	Resend outage – Frontmail retries.

Checklist

• Domain verified: resend._domainkey TXT + send MX and TXT
• DMARC record published (p=none to start)
• API key with Sending access only
• Test connection passes
• From address in the template on the verified domain (not resend.dev)
• Webhook endpoint with delivered, bounced, complained (+ opened/clicked)
• Signing secret (whsec_…) copied into Frontmail