Resend SMTP Settings and Configuration (2026)
Native SMTP relay backed by Amazon SES
Resend exposes a first-party SMTP endpoint at smtp.resend.com with STARTTLS on 587 and implicit TLS on 465. Username is the literal string resend; password is your API key (re_…). No add-on required.
Resend is a developer-first transactional ESP built by the team behind React Email, running on top of Amazon SES infrastructure. The SMTP relay is a thin shim over the same API and rate-limit envelope, so it is the fastest path to production if your framework (Laravel, Django, WordPress with Postmark-style transports) already speaks SMTP but you want React Email templates and Resend’s DX. If you want a bare-metal SES setup, see Amazon SES; if you prefer a longer-tenured transactional relay with EU residency, compare Postmark and Mailgun.
Quick reference
| SMTP server | smtp.resend.com (single global endpoint) |
|---|---|
| Port (STARTTLS) | 587 RECOMMENDED-also 25 and 2587 |
| Port (SSL/TLS) | 465-also 2465 (implicit TLS / SMTPS) |
| Auth mechanism | PLAIN over STARTTLS or SMTPS |
| Username | Literal string resend (not your email) |
| Password | Resend API key, format re_xxxxxxxx |
SMTP configuration
Resend SMTP relay
Drop-in transactional relay for any framework that speaks SMTP, app notifications, password resets, receipts, and any React Email template rendered server-side.
Setup steps
- Add and verify your sending domain in the Resend dashboard under Domains › Add domain, and publish the SPF, DKIM and MX records Resend displays (see next section).
- Create an API key under API keys › Create API key. Give it Sending access only, scoped to the domain you just verified.
- In your application’s mail settings, set host smtp.resend.com, port 587, encryption tls, username resend, password <your re_ key>.
- Send a test to the sandbox mailbox delivered@resend.dev and confirm you see the event in the Resend dashboard Logs tab within a few seconds.
- Switch DNS status to Verified and start sending from a subdomain you control (Resend recommends send.yourdomain.com or a similar dedicated bounce subdomain).
Authentication
Resend runs on Amazon SES underneath, so the DNS records you publish look like a SES setup with Resend-owned selectors added on top. Publish all three record sets before your first send, missing DKIM will silently strip the signature and hurt inbox placement.
SPF and DKIM setup
Resend requires records on a dedicated subdomain (default send) so that your root domain SPF is not disturbed. The dashboard shows the exact values per verified domain.
; SPF on the sending subdomain send.yourdomain.com. TXT "v=spf1 include:amazonses.com ~all" ; MX record for bounce feedback (Amazon SES feedback loop) send.yourdomain.com. MX 10 feedback-smtp.us-east-1.amazonses.com. ; DKIM selector published by Resend (public key generated per domain) resend._domainkey.yourdomain.com. TXT "p=<public_key_provided_by_Resend>"
Once DNS propagates, click Verify DNS records in the dashboard. Verification typically completes in under 10 minutes for most registrars; Cloudflare and Route 53 are usually instant.
DMARC alignment
Resend’s default posture is p=none (monitor mode) so you can start sending immediately without risking legitimate mail being rejected. Once your reports look clean, progress to p=quarantine and then p=reject. A minimal DMARC record for the root domain looks like:
_dmarc.yourdomain.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r"
Resend ships a built-in DMARC reports dashboard so you can review aggregate reports without wiring up a third-party tool. Alignment is relaxed by default (adkim=r, aspf=r), which is what you want when sending from a subdomain of a corporate root.
Rate limits & sending caps
| Metric | Value | Notes |
|---|---|---|
| API / SMTP throughput | 10 req/sec per team (600 rpm) | Shared across all API keys on the team. Higher limits available on request. |
| Recipients per message | 50 in the to field | Split larger sends across batch API calls or Broadcasts. |
| Batch API | 100 emails per call | Available via POST /emails/batch and mirrored by SMTP recipients rule. |
| Message size | 40 MB total | Measured after Base64 encoding, effective raw payload ~28-30 MB. |
| Free tier volume | 3,000/mo · 100/day | Both quotas run in parallel. Paid plans cap overage at 5x monthly quota. |
Resend does not publish an emails/hour figure or a concurrent-SMTP-connections limit; the enforced ceiling is the 10 req/s team quota. Because the relay sits on top of Amazon SES, your effective deliverability envelope also inherits SES bounce/complaint thresholds, keep bounce under 4% and spam complaints under 0.08% to avoid throttling.
Common setup gotchas
SMTP username is literally the string ‘resend’
Unlike Postmark, Mailgun or Amazon SES, the SMTP username here is not your email, account ID or SMTP credential name, it is the fixed string resend. The password is the API key (re_…). New users often paste their account email into the username field and get 535 Authentication failed.
Rate limit is 10 req/sec per team, not per API key
The 10 req/s cap is applied at the team level and shared across every API key. Rotating keys or creating one per environment will not raise the ceiling, you need to open a support request. Consume the ratelimit-remaining and retry-after headers and queue with exponential backoff (Cloudflare Queues, Upstash QStash, or Trigger.dev are common patterns).
Free plan has both a 100/day AND a 3,000/month cap
Both quotas run in parallel on the free tier: sending 100 emails/day for 30 days will still trip the 3,000/month ceiling. The free plan also limits you to 1 verified domain, so multi-tenant setups need at least the $20/mo Pro plan (10 domains).
Bounce > 4% or spam > 0.08% will pause your account
Resend inherits SES-style deliverability floors: bounce rate must stay under 4% and complaint rate under 0.08%. Exceeding either metric triggers throttling and can lead to account review or suspension. Double opt-in, address validation before send, and immediate suppression of hard bounces are not optional at scale.
Migrating SMTP setups
Migrating to Resend
Coming from SendGrid, Mailgun or Postmark, the migration is a config swap: change host to smtp.resend.com, port to 587, username to resend, and password to your API key. Publish the SPF/DKIM/MX records under the send subdomain before flipping traffic. DKIM keys do not carry over from other providers, so plan for a short warmup period. If you were on Amazon SES directly, DMARC alignment should already be relaxed and you can reuse most of your DNS work; you just add Resend’s DKIM selector alongside your existing one.
Migrating from Resend
Because Resend runs on top of Amazon SES, the natural down-migration path is Amazon SES for cost at high volume (typically above 1M emails/month, where SES’s $0.10 per 1,000 undercuts Resend’s $0.90/1,000 overage). Export contacts through GET /contacts, suppressions through GET /suppressions, and re-verify DKIM under SES’s own selectors. If you want managed deliverability with EU residency, Postmark and Brevo are the common landing spots.
Frequently asked questions
What are the SMTP hostname and ports for Resend?
Resend uses a single global endpoint: smtp.resend.com. STARTTLS is available on ports 587 (recommended), 25, and 2587. Implicit TLS (SMTPS) is available on ports 465 and 2465. Port 587 is the default and works in most environments; use 465 if your host blocks 587 outbound.
What username and password do I use with Resend SMTP?
The SMTP username is the literal string “resend”, not your email or account ID. The password is a Resend API key with sending access, in the format re_xxxxxxxx. Create the key in the Resend dashboard under API keys and scope it to the specific domain you verified.
Does Resend SMTP support STARTTLS and implicit TLS?
Yes. STARTTLS is supported on 587, 25 and 2587. Implicit TLS (SMTPS) is supported on 465 and 2465. Plaintext SMTP is not permitted, the server rejects credentials before an encrypted channel is established.
How do I authenticate SMTP with a Resend API key?
Use AUTH PLAIN over STARTTLS or SMTPS with username “resend” and password set to your re_ API key. Nothing else is required, there is no separate SMTP credential like on Amazon SES, and no SASL LOGIN quirk.
What is the SMTP send rate limit on Resend?
The default limit is 10 requests per second per team, or roughly 600 per minute, shared across all API keys and the SMTP relay. There is no separately published emails-per-hour or concurrent-connections figure. Free plan sending caps at 100 emails/day and 3,000/month; higher throughput is available on request for paid plans.
Which SPF, DKIM and DMARC records do I add for Resend?
On a “send” subdomain: SPF TXT record “v=spf1 include:amazonses.com ~all”, an MX record pointing to feedback-smtp.us-east-1.amazonses.com priority 10, and a DKIM TXT record at resend._domainkey with the public key value the dashboard shows. Publish DMARC at _dmarc on the root domain, starting at p=none and progressing to p=quarantine then p=reject once your Resend DMARC dashboard shows clean aggregate reports.
This review follows our email infrastructure testing methodology. We disclose affiliate relationships in our editorial independence policy.
