Symptom: recipient servers report DMARC failures for mail sent through Resend, or you have no DMARC record at all.
1. Confirm the cause: check for a TXT record at _dmarc.yourdomain.com. Missing record means no policy published. Also confirm SPF and DKIM pass, since DMARC relies on them: an email passes DMARC when either SPF or DKIM passes, and fails only when both fail. A verified Resend domain already passes SPF and DKIM.
2. Fix step 1: add a TXT record at _dmarc with a lenient policy and a reporting address, e.g. v=DMARC1; p=none; rua=mailto:dmarc-reports at your domain. Use an address that can actually receive mail; it gets aggregate XML reports showing which IPs send as your domain and whether they pass.
3. Do not jump to p=quarantine or p=reject yet. Send from every app and service that uses the domain, confirm delivery, and inspect headers for dmarc=pass first.
4. Fix step 2: once all your legitimate sources show dmarc=pass, tighten the policy to quarantine, then reject.
5. Verify: send a test email and inspect the headers for dmarc=pass. You can also run Resend's DMARC analyzer on your aggregate reports to visualize pass rates per source.