Amazon SES: SPF, DKIM & DMARC Setup

SPF for Amazon SES

Add include:amazonses.com to your domain's single SPF TXT record, never publish two SPF records. If you send only through Amazon SES, the whole record is:

yourdomain.com.  TXT  "v=spf1 include:amazonses.com ~all"

SES does NOT require you to publish an SPF record on your From (5322.From) domain to send mail, by default SES uses its own subdomain of amazonses.com as the envelope MAIL FROM, and SPF passes against amazonses.com automatically (AWS docs: 'in SES, SPF is implicitly set up for you'). You only publish an SPF record when you configure a custom MAIL FROM domain, and it goes on that MAIL FROM subdomain (e.g. mail.yourdomain.com), NOT the parent: `v=spf1 include:amazonses.com ~all`. Use ~all (softfail); AWS documents this form. include:amazonses.com is a single DNS-lookup include (well under the RFC 7208 10-lookup cap), so SES rarely causes flattening blowups on its own, the risk comes from stacking it with other senders' includes on one domain. IMPORTANT: SPF alone will NOT satisfy DMARC unless you set up a custom MAIL FROM domain whose subdomain aligns with your From domain, the default amazonses.com envelope will not be in DMARC alignment. For most senders, DKIM (Easy DKIM) is the reliable path to DMARC pass, and SPF is optional/secondary.

DKIM for Amazon SES

Use Easy DKIM (recommended): SES console → Configuration → Identities → pick your verified Domain identity → Authentication tab → DomainKeys Identified Mail (DKIM) → Edit → in Advanced DKIM settings choose Identity type 'Easy DKIM', pick RSA_2048_BIT (SES default, recommended) or RSA_1024_BIT, tick DKIM signatures 'Enabled', Save changes. SES then generates THREE CNAME records, publish all three at your DNS provider. SES rotates/manages the three keys automatically over time, so leave all three in place permanently. If Route 53 is your DNS provider under the same account, SES can publish them for you. DKIM is only active once SES detects the CNAMEs (identity DKIM status flips to 'Successful' / Identity status 'Verified'), publishing alone is not enough, the domain identity must verify (can take up to 72h to propagate). Alternative: BYODKIM (Bring Your Own DKIM) lets you generate your own key pair and publish ONE TXT record at {selector}._domainkey.yourdomain.com instead of the three CNAMEs.

Method: CNAME

abc123def456ghijklmnop._domainkey.yourdomain.com.  CNAME  abc123def456ghijklmnop.dkim.amazonses.com.
tuv456wxy789zabcdefghi._domainkey.yourdomain.com.  CNAME  tuv456wxy789zabcdefghi.dkim.amazonses.com.
mno789pqr012stuvwxyzab._domainkey.yourdomain.com.  CNAME  mno789pqr012stuvwxyzab.dkim.amazonses.com.
(The token strings are unique per identity and shown in the SES console, copy the EXACT values SES gives you. Note: in newer Regions/cells the CNAME value may include a Region segment, e.g. {token}.dkim.us-west-2.amazonses.com, always use the exact target SES displays rather than assuming the bare .dkim.amazonses.com form.)

DMARC for Amazon SES

Publish DMARC at _dmarc.yourdomain.com as a TXT record. With Easy DKIM enabled, the DKIM signature's d= is your own domain, so DKIM alignment passes and DMARC passes on DKIM alone, this is the recommended path for SES. SPF-based DMARC alignment does NOT work with the SES default MAIL FROM (envelope domain is a subdomain of amazonses.com, which will never align with your From domain); to get SPF into DMARC alignment you must configure a custom MAIL FROM domain that is a subdomain of your From domain. Start at p=none with rua reporting to observe, then move to p=quarantine and p=reject once DKIM is confirmed passing/aligned. DMARC only requires ONE of SPF or DKIM to pass AND align, so Easy DKIM alone is sufficient. Note the alignment mode: SES DKIM aligns in relaxed mode by default (subdomains align to the org domain).

_dmarc.yourdomain.com.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]; fo=1; adkim=r; aspf=r"

Common Amazon SES mistakes

• Publishing the three DKIM CNAMEs but forgetting that the SES identity must reach DKIM status 'Successful', until SES detects them, mail may be sent unsigned. Wait for the console/verification to confirm (propagation can take up to 72 hours).
• CNAME vs TXT confusion: SES Easy DKIM uses THREE CNAME records (pointing to *.dkim.amazonses.com), not TXT. Some DNS panels auto-append your domain to the CNAME host, do not double-append (e.g. avoid ...._domainkey.yourdomain.com.yourdomain.com) and do not add an extra leading underscore (correct: abc123._domainkey.domain.com, NOT _abc123._domainkey.domain.com).
• Assuming SPF alone will make DMARC pass. The default SES MAIL FROM is a subdomain of amazonses.com, so SPF is authenticated but NOT aligned to your From domain, DMARC will fail on SPF. Rely on Easy DKIM, or set up a custom MAIL FROM domain for SPF alignment.
• Custom MAIL FROM MX must be exactly ONE record and region-correct: `10 feedback-smtp.{region}.amazonses.com` where {region} matches the AWS Region you actually send from (e.g. us-east-1, us-west-2, eu-west-1). A wrong region or a second/extra MX record makes the custom MAIL FROM setup fail (state goes to 'Failed').
• SES identities are per-Region. If you send from multiple AWS Regions, each Region generates its own DKIM tokens/identity, you must verify DKIM and publish the CNAMEs in every Region you send from.
• Only put the custom-MAIL-FROM SPF record on the dedicated MAIL FROM subdomain (which must not be used to send or receive other mail), not on your apex/From domain, and never merge multiple `v=spf1` records; a domain may have only one SPF TXT record.
• Removing/adding DKIM CNAMEs after setup: SES rotates among the three keys, so deleting one (thinking only one is 'active') breaks signing during rotation. Keep all three published.

Verify & related