403 domain mismatch: your from address uses a domain you never verified

Not specified by the original author.

Symptom: 403 on send; key works, User-Agent is set, domain page shows a verified domain.

1. Confirm the cause: open the Resend Domains page and note exactly what you verified (e.g. sending.domain.com). Compare it character by character with the domain in your request's from field.
2. The usual trap: verifying a subdomain but sending from the root domain, or vice versa. These are different domains to Resend and the check is exact.
3. Fix option A (recommended): change the from address in your API calls to the exact verified domain.
4. Fix option B: delete the domain in Resend, then add and verify the domain that matches what your code actually sends from.
5. Verify: resend and confirm the 403 is gone. If it persists with an exact match, confirm the domain shows fully verified (not pending) and that the API key has the needed permissions.

Documented in Resend knowledge base: 403s happen when the API request's from domain does not exactly match the verified domain, including subdomains; the documented fixes are updating the request or re-adding the matching domain. Evidence: resend.com/docs/knowledge-base/403-error-domain-mismatch.