Resend says "You can only send testing emails to your own email address". How do I fix it?

• Contact form, welcome or notification emails reach you but no one else.
• The send fails with HTTP 403 and the message: "You can only send testing emails to your own email address (…). To send emails to other recipients, please verify a domain at resend.com/domains, and change the from address to an email using this domain." (Resend: Errors)
• The form says "Sent!" but nothing arrives, because the app shows success before checking the response.
• You verified a domain, but it still fails (see step 4).

Resend's knowledge base explains: "The resend.dev domain is only available for testing purposes and can only send emails to the email address associated with your Resend account" (Resend: 403 error using resend.dev).

AI builders often start with that test sender because it works without any setup. Resend's Lovable guide notes: "By default, Lovable deploys using the test domain resend.dev. Once your custom domain is verified, the function does not automatically redeploy or update the sender address" (Resend: Send emails with Lovable). So even after you verify a domain, the app keeps using onboarding@resend.dev until the code changes.

A related 403, "The domain.com domain is not verified", means the from address uses a domain that isn't verified in your Resend account (Resend: Errors). A common case is sending "from" a Gmail address.

1. Add and verify your domain in Resend

From Resend's steps: go to the Domains page in your Resend dashboard, click Add Domain, enter your domain, and add the DNS records it asks for at your DNS provider (Resend KB). Wait until the domain shows as verified. Many people use a subdomain such as mail.yourdomain.com.

2. Change the from address in code

Find where the app calls Resend, usually a Supabase Edge Function or server route, and change the sender:

await resend.emails.send({
  from: 'Your App <hello@yourdomain.com>', // was onboarding@resend.dev
  to: [recipient],
  subject: 'Thanks for getting in touch',
  html: '<p>...</p>',
})

3. Redeploy the function

The live function keeps its old code until you redeploy it (Resend: Lovable guide). In Lovable, ask the chat to update the sender and redeploy the function. In Bolt or Cursor, redeploy the Edge Function or server and republish the site.

4. Still failing after verifying?

Resend's checklist: confirm the domain is fully verified on the Domains page, and that the from field uses that verified domain, not resend.dev (Resend KB). Also check that the API key belongs to the same Resend account as the verified domain, and, if it's a Sending access key limited to one domain, that it's limited to this one (Lovable: Resend connector).

5. Show success only after a real response

Make the form show "Sent" only after the server returns 2xx, and show an error otherwise. Otherwise the next email failure will be invisible again.

For Lovable Cloud apps: consider Lovable Emails

Lovable's docs say that for standard transactional emails (signup confirmations, password resets, receipts, internal notifications) you can use the built-in Lovable Emails, which "can also send from your own domain". Use the Resend connector when you need marketing email or already manage sending in Resend (Lovable: Resend connector).

Supabase auth emails are a separate setting

If the emails that fail are Supabase signup confirmation or password reset emails, the fix is Supabase's SMTP settings, not this code. See Supabase confirmation email not sending?

Paste this into Lovable, Bolt, Cursor, Replit, v0 or whichever tool you build with:

Emails sent through Resend only reach my own address and other recipients get 403 "You can only send testing emails to your own email address". I've verified the domain <yourdomain.com> in Resend. Fix only the email sending:
1. Find every Resend send call (Edge Functions and server code) and change the from address to "<App name> <hello@yourdomain.com>". Remove onboarding@resend.dev everywhere.
2. Keep the Resend API key in server-side secrets only, never in frontend code.
3. Make the form show success only after the server returns a 2xx, and show a clear error otherwise.
4. Redeploy the function(s) and tell me which ones you redeployed.
Don't change anything else.

1. Submit the form on the live site using an address that isn't your Resend account email (a friend's, or a second inbox).
2. Check the email arrives, and that Resend's activity log shows the send as delivered.
3. Check the email's "from" shows your domain.

Heedza never submits forms, so it can't tell you an email didn't send. It checks on a schedule that your landing, signup, login and checkout pages load and show their forms, and sends you a screenshot and a fix prompt when one doesn't. The free scan reports exposed secret keys it finds in your homepage and its scripts (such as OpenAI, Anthropic, Stripe and Supabase secret keys). It doesn't look for Resend keys, so search your frontend code for re_ yourself and keep the key in server-side secrets.