Symptom: 403 on send; key works, User-Agent is set, domain page shows a verified domain.
1. Confirm the cause: open the Resend Domains page and note exactly what you verified (e.g. sending.domain.com). Compare it character by character with the domain in your request's from field.
2. The usual trap: verifying a subdomain but sending from the root domain, or vice versa. These are different domains to Resend and the check is exact.
3. Fix option A (recommended): change the from address in your API calls to the exact verified domain.
4. Fix option B: delete the domain in Resend, then add and verify the domain that matches what your code actually sends from.
5. Verify: resend and confirm the 403 is gone. If it persists with an exact match, confirm the domain shows fully verified (not pending) and that the API key has the needed permissions.