SPF, DKIM and DMARC for Amazon SES, Explained
For Amazon SES you need five kinds of DNS records: three DKIM CNAMEs from Easy DKIM, an MX and an SPF TXT record for a custom MAIL FROM subdomain, and one DMARC TXT record. DKIM proves SES signed your email, SPF proves SES may send for you, and DMARC tells inboxes what to do when checks fail.
What does each record do, in plain English?
- DKIM adds a signature to every email. Inboxes check it against your DNS to confirm you sent it and nobody changed it.
- SPF lists which servers may send mail for a domain.
- DMARC ties it together. It requires SPF or DKIM to pass and match your From domain, and tells inboxes what to do if not.
What records does Amazon SES need?
Replace yourdomain.com and the region. Copy exact DKIM values from your SES console.
| Purpose | Type | Name | Value |
|---|---|---|---|
| DKIM (x3) | CNAME | [token]._domainkey.yourdomain.com | [token].dkim.amazonses.com |
| MAIL FROM bounces | MX | mail.yourdomain.com | 10 feedback-smtp.[region].amazonses.com |
| SPF | TXT | mail.yourdomain.com | v=spf1 include:amazonses.com ~all |
| DMARC | TXT | _dmarc.yourdomain.com | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com |
Step by step
- Turn on Easy DKIM when you create your domain identity in SES. Add the three CNAME records it shows.
- Set a custom MAIL FROM domain in the identity settings, such as
mail.yourdomain.com. Add the MX and SPF records for it. - Publish DMARC with
p=nonefirst, so nothing is blocked while you check reports. - Wait for verification. SES marks DKIM and MAIL FROM as verified once DNS propagates, usually within an hour.
- Send a test to a Gmail address, open it, choose "Show original", and confirm SPF, DKIM and DMARC all say PASS.
- Tighten DMARC after 2–4 weeks of clean reports: move to
p=quarantine, thenp=reject.
Why do I need a custom MAIL FROM domain?
By default SES uses its own amazonses.com address as the bounce address. SPF then passes for Amazon's domain, not yours, so it doesn't align for DMARC. DKIM still aligns, so DMARC can pass, but a custom MAIL FROM gives you two aligned checks instead of one.
What are the most common mistakes?
- Adding a second SPF record on the root domain instead of merging. A domain must have only one SPF record
- Pasting the full domain into a DNS field that already appends it, creating
_domainkey.yourdomain.com.yourdomain.com - Turning on Cloudflare's proxy for CNAME records; DKIM CNAMEs must be "DNS only"
- Jumping straight to
p=rejectbefore checking reports
These records are also mandatory for bulk senders under Gmail and Yahoo's rules; see the bulk sender checklist. EazyEmailer doesn't create these records for you; it checks that your sender address is verified in SES before each campaign.
FAQ
Is DKIM alone enough?
For DMARC to pass, one aligned check is enough, and SES's DKIM provides it. Bulk senders to Gmail still need SPF and a DMARC record published.
Do SPF changes on my subdomain affect Google Workspace mail?
No. The SPF record for mail.yourdomain.com is separate from your root domain's SPF.
How do I read DMARC reports?
The rua address receives XML reports daily. Use a free DMARC report viewer to turn them into readable summaries.
What DMARC policy should I end with?
p=reject gives the strongest protection against spoofing, once you're sure every legitimate sender passes.