Resend domain DNS roles

  1. In Resend → Domains → Add domain, use a subdomain (e.g. updates.example.com), not the apex.

  2. Set Custom Return-Path to send (or accept the default that differs from tracking).

  3. Set Tracking subdomain to links.

  4. Enable click tracking if needed; leave open tracking off unless you accept the tradeoffs.

  5. Copy the DNS records Resend shows into the org infra Pulumi stack (Cloudflare provider) and apply.

  6. Wait for verification; set the app From to a local-part on the verified host.

Background: Resend subdomain DNS roles.