Setup guide

SPF · DKIM · DMARC

Set up SPF, DKIM and DMARC on Amazon SES

The DNS records that make Gmail trust mail you send through Amazon SES — three DKIM CNAMEs, a MAIL FROM subdomain for SPF, and DMARC on your root.

Check your setup free → Amazon SES docs ↗

Before you start

What Amazon SES needs from your DNS.

Amazon SES relays your mail, but receivers judge it on your DNS, not on the fact that AWS carried it. SES leans on DKIM for authentication: enable Easy DKIM and it publishes three CNAME records that let SES sign every message with a key aligned to your domain. That alignment is what satisfies DMARC, so DKIM is the record to get right first.

SPF works differently on SES than on a mailbox host. By default SES sends with a subdomain of amazonses.com as the MAIL FROM (envelope) domain, which passes SPF but does not align with the domain in your From header. To align SPF for DMARC you configure a custom MAIL FROM subdomain — say mail.yourdomain.com — and publish an MX and an SPF TXT record on that subdomain, not on your root. This is why you do not add an amazonses.com include to your existing root SPF.

Since February 2024, Google and Yahoo require anyone sending in bulk to publish SPF, DKIM and DMARC. On Amazon SES that means enabling Easy DKIM, setting up the MAIL FROM subdomain, and adding a DMARC record on your root domain before your volume grows.

The records to publish

Copy these into your DNS.

Add each record at your DNS provider — the company where your domain is registered, not Amazon SES. Then run the checker to confirm every one resolves.

DKIM CNAME 1 record

host  <token1>._domainkey type  CNAME

value generated by Amazon SES

Enable Easy DKIM on your domain identity in the SES console (Identities → your domain → Authentication). SES generates three unique tokens; each record points <token>._domainkey.yourdomain to <token>.dkim.amazonses.com. Copy the exact names and targets from the console — they are specific to your domain and Region.

DKIM CNAME 2 record

host  <token2>._domainkey type  CNAME

value generated by Amazon SES

The second of the three Easy DKIM CNAMEs. Publish all three; SES marks the domain verified only once every one resolves. Do not add a leading underscore before the token — the name is token._domainkey, exactly as shown in the console.

DKIM CNAME 3 record

host  <token3>._domainkey type  CNAME

value generated by Amazon SES

The third Easy DKIM CNAME. These are CNAMEs, not TXT records — SES hosts the actual public key at dkim.amazonses.com so it can rotate keys without you touching DNS again.

MAIL FROM MX record

host  mail type  MX 
10 feedback-smtp.us-east-1.amazonses.com

Publish this on your custom MAIL FROM subdomain (here mail.yourdomain.com), not the root. Replace us-east-1 with the AWS Region you send from. Exactly one MX record is allowed on the MAIL FROM subdomain — a second one makes the setup fail. It receives bounce and complaint notifications.

SPF (MAIL FROM) record

host  mail type  TXT 
v=spf1 include:amazonses.com ~all

This SPF record belongs on the custom MAIL FROM subdomain, alongside the MX above — not on your root domain. It authorises SES to send for that subdomain and gives you SPF alignment for DMARC. Leave your root domain SPF untouched.

DMARC record

host  _dmarc type  TXT 
v=DMARC1; p=none; rua=mailto:[email protected]

On your root domain. Start at p=none to watch alignment, then raise to quarantine and reject once your reports show SES mail passing DKIM (and SPF, if you set up the MAIL FROM subdomain). Point rua at an address you actually read.

Step by step

The whole setup, in order.

  1. 1 Verify your domain and enable Easy DKIM. In the SES console under Configuration → Identities, create a domain identity for your domain. Choose Easy DKIM at the default 2048-bit length and enable DKIM signatures. SES then shows three CNAME records to publish.
  2. 2 Publish the three DKIM CNAMEs. At your DNS host — not in AWS unless you use Route 53 — add all three CNAME records exactly as the console lists them, pointing each token._domainkey name at its token.dkim.amazonses.com target. Do not prepend an underscore to the token.
  3. 3 Set up a custom MAIL FROM subdomain. On the identity, edit Custom MAIL FROM domain and enter a dedicated subdomain such as mail.yourdomain.com that you do not otherwise send from or receive on. SES gives you one MX and one SPF TXT record to publish on that subdomain.
  4. 4 Publish the MAIL FROM MX and SPF records. Add the MX (10 feedback-smtp.<region>.amazonses.com) and the SPF TXT (v=spf1 include:amazonses.com ~all) on the MAIL FROM subdomain. Use the Region you send from, and keep exactly one MX record there.
  5. 5 Publish DMARC on your root. Add the _dmarc TXT record on your root domain at p=none with an rua address you monitor. This breaks nothing while you confirm SES mail is aligning.
  6. 6 Wait, then verify. DNS changes can take up to 72 hours for SES to detect. Once the identity shows Verified and the MAIL FROM state shows Success, run a full check here to confirm the DKIM CNAMEs resolve, SPF is under the 10-lookup limit, and DMARC is graded.

Where it goes wrong

The mistakes specific to Amazon SES.

Publishing DKIM as TXT Easy DKIM uses CNAME records, not the TXT record you paste for a mailbox host. If you convert the value to a TXT record it will never verify. Publish all three as CNAMEs pointing at dkim.amazonses.com.
An extra underscore on the DKIM name The name is token._domainkey.yourdomain. Some panels or habits add a leading underscore before the token, giving _token._domainkey, which SES cannot match. Use the name exactly as the console shows it.
Adding amazonses.com to your root SPF SES sends from a MAIL FROM subdomain, so the include belongs there, not on your root. Adding include:amazonses.com to your root SPF does nothing for alignment and eats into your root record's 10-lookup budget.
Two MX records on the MAIL FROM subdomain The custom MAIL FROM setup requires exactly one MX record on that subdomain. A second MX — often a leftover from another service — makes SES mark the setup as failed and fall back to the default MAIL FROM.
Wrong Region in the MX The feedback-smtp host is Region-specific. If your MX says us-east-1 but you send from eu-west-1, the MAIL FROM setup fails. Match the Region to where the identity lives.
Relying on SPF alone for DMARC Without a custom MAIL FROM domain, SES mail passes SPF against amazonses.com but does not align it to your domain. DKIM is what carries DMARC on SES, so make sure Easy DKIM is verified even if you skip the MAIL FROM subdomain.

Confirm it worked

Do not trust it until you have checked it.

DNS takes a few minutes to propagate. Once it has, run a full check: it reads all three records live, counts your SPF lookups, confirms the Amazon SES DKIM selector resolves, and grades your DMARC policy — the exact things that decide whether Gmail and Outlook trust your mail.

Check your domain → Or send a test email

Common questions

About Amazon SES, specifically.

What is the SPF record for Amazon SES? v=spf1 include:amazonses.com ~all, but published as a TXT record on a custom MAIL FROM subdomain (such as mail.yourdomain.com) alongside an MX record, not on your root domain. SES uses that subdomain as the envelope sender, which is what gives you SPF alignment for DMARC.
What is the Amazon SES DKIM selector? There is no single fixed selector. Easy DKIM generates three unique tokens per domain and publishes them as CNAME records at token._domainkey.yourdomain pointing to token.dkim.amazonses.com. Copy the exact names and targets from the SES console — they differ by domain and Region.
Why is my Amazon SES DKIM failing? Usually one of three things: you published the tokens as TXT records instead of CNAMEs; you added a leading underscore before the token in the name; or DNS has not propagated yet. SES can take up to 72 hours to detect all three CNAMEs before the domain shows Verified.
Do I add the amazonses.com include to my existing SPF record? No. SES sends from a separate MAIL FROM subdomain, so the SPF record with include:amazonses.com goes on that subdomain, not on your root. Leave your mailbox provider's root SPF as it is.
Do I need a custom MAIL FROM domain for Amazon SES? Not to send, but yes if you want SPF to align for DMARC. Without it, SES mail passes SPF against amazonses.com but that does not align to your domain, so your DMARC pass rests entirely on DKIM. Setting up the MAIL FROM subdomain adds SPF alignment as a second path.
How long does Amazon SES take to verify DKIM? Up to 72 hours for SES to detect the CNAME records after you publish them, though it is often much faster. The identity status changes to Verified once all three resolve — do not conclude it has failed until that window passes.

Set it once. Know it stays set.

A DKIM key rotates, a vendor changes its SPF, an IP gets listed — and your carefully-configured domain quietly breaks. Monitoring watches all of it and tells you the day it changes.

Check your domain free → See monitoring