DMARC failing on your Resend domain: start with p=none and a rua address

TL;DR: DMARC needs a TXT record at dmarc on your domain, and it only passes when SPF or DKIM pass. A verified Resend domain already passes both, so a DMARC failure is usually a missing or too-strict record. Confirm the cause: check for a TXT record at dmarc.yourdomain.com. Fix step 1: add a TXT record at _dmarc with a lenient policy and a reporting address, e.g. v=DMARC1; p=none; rua=mailto:dmarc-reports at your domain.

The error

recipient servers report DMARC failures for mail sent through Resend, or you have no DMARC record at all.

The fix

1. Confirm the cause: check for a TXT record at _dmarc.yourdomain.com. Missing record means no policy published. Also confirm SPF and DKIM pass, since DMARC relies on them: an email passes DMARC when either SPF or DKIM passes, and fails only when both fail. A verified Resend domain already passes SPF and DKIM.
2. Fix step 1: add a TXT record at _dmarc with a lenient policy and a reporting address, e.g. v=DMARC1; p=none; rua=mailto:dmarc-reports at your domain. Use an address that can actually receive mail; it gets aggregate XML reports showing which IPs send as your domain and whether they pass.
3. Do not jump to p=quarantine or p=reject yet. Send from every app and service that uses the domain, confirm delivery, and inspect headers for dmarc=pass first.
4. Fix step 2: once all your legitimate sources show dmarc=pass, tighten the policy to quarantine, then reject.
5. Verify: send a test email and inspect the headers for dmarc=pass. You can also run Resend's DMARC analyzer on your aggregate reports to visualize pass rates per source.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: DMARC failing on your Resend domain.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current DMARC behavior.

Documented in Resend docs: DMARC is a TXT record at _dmarc; it relies on SPF and DKIM; a verified domain already passes both; a message passes DMARC if either SPF or DKIM passes; start with p=none plus a rua reporting address, confirm dmarc=pass in headers, then move to quarantine or reject. Evidence: resend.com/docs/dashboard/domains/dmarc.