Resend domain shows partially_verified: one of two CNAME records fails

TL;DR

Symptom: domain status reads partially_verified instead of verified. Each CNAME is verified on its own, so one can pass while the other fails.

Steps

1. Confirm the cause: this status applies to domains created after August 2026 that show two CNAME records. Each CNAME is verified on its own, so one can pass while the other fails.
2. Note what still works: you can send mail while partially verified, but you have no fallback sending server, so treat it as degraded, not done.
3. Fix: open the domain details page and find which of the two CNAMEs is flagged. Correct only that record at your DNS provider, copying the exact name and value from Resend.
4. Check the usual CNAME traps for the failing one: it must not be proxied (Cloudflare orange cloud), and no other record type may exist on the same subdomain (a CNAME cannot co-exist with A, TXT, or MX records there).
5. Verify: hit "Restart verification" and confirm the status moves to verified. If the failing CNAME sits on a subdomain you cannot clear, configure a different Return-Path subdomain and use the records Resend generates for it.

When to use

You are seeing this: Confirm the cause: this status applies to domains created after August 2026 that show two CNAME records. Use this skill when you run into "Resend domain shows partially_verified: one of two CNAME records fails".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Edge cases

• Note what still works: you can send mail while partially verified, but you have no fallback sending server, so treat it as degraded, not done.

Documented in Resend knowledge base: domains created after August 2026 may show two CNAME records verified independently; one failing gives partially_verified, which can still send but lacks a fallback sending server. Evidence: resend.com/docs/knowledge-base/what-if-my-domain-is-not-verifying.