Amazon SES email authentication: SPF, DKIM and DMARC
With Amazon SES, DKIM aligns out of the box once the three Easy DKIM CNAMEs are published, but SPF only aligns if you set up a custom MAIL FROM subdomain. This guide shows both and why the SPF include does not belong on your root domain.
Record values checked against Amazon SES’s own documentation on 2026-11-10. Every section links its source.
Check your domain against Amazon SES
Enter the domain you send from. We run the checks on the live DNS and show what is missing.
Free, no signup. The scan reads public DNS records only.
SPF for Amazon SES
The SPF record for this provider does not go on your root domain. It goes on a dedicated bounce subdomain (<mail-from-subdomain>.<your-domain>), next to an MX record.
"v=spf1 include:amazonses.com ~all"That include costs 1 DNS lookup measured on 2026-11-10, but on the subdomain, so it does not spend the lookup budget of your root domain.
- The SPF record SES asks for goes on the custom MAIL FROM subdomain, together with an MX record. It does not go on your root domain.
- By default SES uses a subdomain of amazonses.com as the MAIL FROM domain. SPF passes there, but it does not align with your From domain, so DMARC then relies on DKIM.
- Your root-domain SPF record does not need an SES include for this setup, which keeps the 10-lookup budget of the root domain free for other senders.
- The SES docs show the value with the quotation marks; some DNS hosts do not need them.
DKIM for Amazon SES
Where: Amazon SES console: Configuration > Identities > your domain > Authentication tab > DomainKeys Identified Mail (DKIM)
- Create a domain identity for your domain and keep Easy DKIM selected. SES signs with a 2048-bit key by default; you can pick 1024 if your DNS host needs it.
- On the Authentication tab, open Publish DNS records and copy the three CNAME records, or download the .csv.
- Publish all three at your DNS host. If your domain is in Route 53 on the same account, SES can publish them for you.
- Wait for SES to detect them. Changes can take up to 72 hours to propagate. The identity then shows DKIM configuration Successful and status Verified.
| Type | Name | Value |
|---|---|---|
| CNAME | <token>._domainkey | <token>.dkim.<signing hosted zone>Three records with three different tokens. The hosted-zone part varies by AWS Region and identity (for example token.dkim.us-west-2.amazonses.com); copy the value from the console. |
Selector. SES selectors are random tokens, one per record, so there is no name to type into the DKIM checker. Discovery will not find them; paste a token from the console if you want a direct lookup.
- The underscore in _domainkey is required. If your DNS host refuses underscores, contact its support.
- Do not add an extra leading underscore: abc123._domainkey.example.com is correct, _abc123._domainkey.example.com is not.
- Verification records differ per AWS Region. To send from one domain in several Regions, create and verify an identity in each.
DMARC with Amazon SES
DMARC passes when SPF or DKIM passes and aligns with the domain in the From address. Start by watching, not blocking.
- SES passes DMARC when SPF or DKIM passes and aligns. With Easy DKIM the signing domain is your domain, so DKIM alignment holds. To also align SPF, set up the custom MAIL FROM domain.
- AWS’s own rollout advice is the same staged path used below: p=none to collect reports, then quarantine, then reject, starting with subdomains.
- A strict SPF alignment tag (aspf=s) breaks SPF alignment with SES, because the MAIL FROM subdomain differs from the From domain. Leave aspf at its relaxed default.
Step 1
Monitor
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comPublish at _dmarc.<your-domain>. Nothing changes for delivery; receivers start sending aggregate reports to the rua address. Collect two to four weeks of reports, list every service that sends as your domain, and fix each one that fails SPF or DKIM alignment.
Step 2
Quarantine
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.comFailing mail goes to spam. Start with a small pct and raise it in steps (10, 25, 50, 75, 100) while the reports stay clean. pct is a rollout tool, not a permanent setting.
Step 3
Reject
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.comFailing mail is refused. This is the goal for any domain that sends mail. Keep the rua address so you notice when a new sender breaks.
A rua address on a different domain than the one you protect needs an authorisation record published by the receiving domain (<your-domain>._report._dmarc.<report-domain> as a TXT record with the value v=DMARC1;), otherwise receivers will not deliver the reports. Subdomains inherit the DMARC record of the parent domain unless they publish their own.
Custom MAIL FROM subdomain
Choose a subdomain you use for nothing else, for example mail.example.com. SES shows the exact records on the identity. Publish exactly one MX record there, or the setup fails.
| Type | Name | Value |
|---|---|---|
| MX | <mail-from-subdomain> | 10 feedback-smtp.<region>.amazonses.comReplace <region> with the AWS Region where you verify the identity, such as us-east-1 or eu-west-1. |
| TXT | <mail-from-subdomain> | "v=spf1 include:amazonses.com ~all"The SPF record for the MAIL FROM subdomain. |
Common Amazon SES mistakes
- Putting the SES SPF record on the root domain. It belongs on the custom MAIL FROM subdomain.
- Using a MAIL FROM subdomain that also sends or receives mail. AWS says it must not be used for anything else.
- Publishing more than one MX record on the MAIL FROM subdomain. SES setup fails with multiple MX records.
- Expecting SPF to align with the default amazonses.com MAIL FROM. It passes, but it does not align.
- Switching DKIM from BYODKIM to Easy DKIM while sending. Until SES confirms DNS, mail can go out unsigned.
- Publishing the DKIM CNAMEs in one Region and sending from another. Records are per Region.
- Setting aspf=s in DMARC when you rely on SPF alignment through the MAIL FROM subdomain.
Amazon SES email authentication FAQ
Does Amazon SES need an SPF include on my domain?
Not on the root domain. SES asks for include:amazonses.com in an SPF record on the custom MAIL FROM subdomain, next to an MX record. DKIM is what aligns by default.
How many DKIM records does Amazon SES need?
Three CNAME records for Easy DKIM, each with its own token. You publish them under <token>._domainkey on your domain.
How long until Amazon SES detects the records?
AWS says changes to DNS settings can take up to 72 hours to propagate. A custom MAIL FROM check also runs for 72 hours before it is marked Failed.
Does Amazon SES pass DMARC without a custom MAIL FROM?
Yes, through DKIM, as long as the signing domain is your From domain. Without a custom MAIL FROM, SPF passes but does not align.
Can I have SPF records for both Amazon SES and my other senders?
Yes, but in one record. A domain must publish exactly one v=spf1 TXT record. Add each sender as an include or an ip4/ip6 term to that record. Two records give a permerror and both are ignored.
How do I check my Amazon SES authentication after changing DNS?
Enter your domain in the check on this page. It runs the IntoDNS.ai scan, the SPF checker (which counts DNS lookups) and, where the selector is known, the DKIM checker. DNS changes can take time to propagate, so re-check later.