## TL;DR

Fix option A (recommended): change the from address in your API calls to the exact verified domain. Fix option B: delete the domain in Resend, then add and verify the domain that matches what your code actually sends from.

## Steps

1. Symptom: 403 on send; key works, User-Agent is set, domain page shows a verified domain.

2. Confirm the cause: open the Resend Domains page and note exactly what you verified (e.g. sending.domain.com). Compare it character by character with the domain in your request's from field.
2. The usual trap: verifying a subdomain but sending from the root domain, or vice versa. These are different domains to Resend and the check is exact.
3. Fix option A (recommended): change the from address in your API calls to the exact verified domain.
4. Fix option B: delete the domain in Resend, then add and verify the domain that matches what your code actually sends from.
5. Verify: resend and confirm the 403 is gone. If it persists with an exact match, confirm the domain shows fully verified (not pending) and that the API key has the needed permissions.

## When to use

You are seeing this: Symptom: 403 on send; key works, User-Agent is set, domain page shows a verified domain. Use this skill when you run into "403 domain mismatch: your from address uses a domain you never verified".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.