Set up SPF, DKIM and DMARC for Amazon SES

Records at a glance

Set up SPF for Amazon SES

You don’t need to add SES to the SPF record on your main domain. Receivers check SPF against the envelope sender (MAIL FROM), and by default SES uses its own subdomain of amazonses.com there. That passes SPF, but for Amazon’s domain, not yours.

The SPF record that matters is the one on your custom MAIL FROM subdomain: v=spf1 include:amazonses.com ~all. As of September 2026, amazonses.com lists IP ranges directly, so the include costs one DNS lookup. Because it lives on its own subdomain, it doesn’t count against the lookup budget of your main domain’s SPF record.

If SES is the only thing sending from the MAIL FROM subdomain, keep that record as is. If you also send as your root domain through another service, the root record stays separate, for example:

v=spf1 include:_spf.google.com ~all

Set up Easy DKIM

1. Open the SES console in the Region you send from. Under Configuration, choose Identities, then Create identity and choose Domain. (For an existing identity, open it, go to the Authentication tab and choose Edit in the DKIM container.)
2. Under Advanced DKIM settings, choose Easy DKIM and a signing key length: RSA_2048_BIT (the default) or RSA_1024_BIT. Make sure DKIM signatures is Enabled.
3. Create the identity, then expand Publish DNS records and copy the three CNAME records. If your domain is in Route 53 in the same account, SES can publish them for you.
4. Add the CNAMEs at your DNS host exactly as shown. When SES finds all three, DKIM configuration shows Successful and the identity shows Verified. That can take up to 72 hours.

SES signs every message from a verified domain with that domain’s key once Easy DKIM is successful. To confirm, send a test and look for dkim=pass with header.d= your domain in the Authentication-Results header. Identities are per Region: sending from a second Region means a second identity and its own records.

Make it pass DMARC (alignment)

• DKIM aligns once Easy DKIM is set up, because SES signs with your domain. This is the path that makes SES mail pass DMARC.
• SPF doesn’t align by default. The envelope sender is an amazonses.com address. Fix it with a custom MAIL FROM domain on a subdomain you own.

To set up a custom MAIL FROM domain:

1. Open the verified domain identity, and in the Custom MAIL FROM domain pane choose Edit.
2. Select Use a custom MAIL FROM domain and enter a subdomain, such as mail. It must not be a subdomain you send From or receive mail at.
3. For Behavior on MX failure, choose Use default MAIL FROM domain (mail keeps flowing but SPF stops aligning) or Reject message (SES refuses to send).
4. Publish exactly one MX record and the SPF TXT record from the table above on that subdomain. SES checks for up to 72 hours and emails you when it succeeds.

With relaxed alignment (the DMARC default), mail.example.com aligns with example.com. If your DMARC record has aspf=s, SPF can’t align through a subdomain, so leave it relaxed. DMARC alignment explains why.

Add a DMARC record

v=DMARC1; p=none; rua=mailto:<your report address>

DMARC Dojo recognizes Amazon SES in DMARC reports, so you can see SES traffic separately from your other senders and confirm it passes with alignment before you move to quarantine and reject. If you also use DMARC Dojo’s hosted SPF, you add senders to your root domain in the dashboard instead of editing DNS.

Troubleshooting

• DKIM stays Pending. The DNS host appended your domain to the name, creating <token>._domainkey.example.com.example.com. Enter the name without the domain, or add a trailing dot to the full name.
• DMARC reports show SPF failing for SES mail. That’s expected without a custom MAIL FROM, because SPF is checked for amazonses.com. DMARC still passes through DKIM; add a custom MAIL FROM if you want both.
• Custom MAIL FROM setup Failed. The subdomain has more than one MX record, or the MX points at the wrong Region. Fix the record and restart the setup.
• Mail from a new Region isn’t signed. Identities and DKIM tokens are per Region. Create and verify the identity in that Region too.
• Switching from BYODKIM to Easy DKIM. SES may send unsigned mail while Easy DKIM is pending. Switch during a quiet period or test on a subdomain first.