How to set up SPF, DKIM & DMARC for Amazon SES

Amazon SES authenticates through Easy DKIM — three CNAMEs pointing at keys Amazon rotates for you. SPF needs one extra decision: by default SES uses amazonses.com as the envelope sender, which doesn't align with your domain, so set a custom MAIL FROM subdomain.

DKIM (Easy DKIM)

SES shows three CNAME records when you create the domain identity — the tokens are unique per identity.

Type	`CNAME`
Host / Name	`abc123example._domainkey`
Value / Content	`abc123example.dkim.amazonses.com` Example only — SES Console → Verified identities → your domain → DKIM shows the three exact host/target pairs.

SES Console → Verified identities → Create identity → Domain, with Easy DKIM (2048-bit) selected.
Publish the three CNAMEs shown (or let SES do it automatically if your DNS is Route 53).
Wait for the identity to show DKIM: verified.

SPF — via a custom MAIL FROM domain

Configure a custom MAIL FROM (e.g. mail.yourdomain.com) on the identity, then publish these two records on that subdomain. Without this, SPF authenticates amazonses.com and doesn't align — DKIM alone still passes DMARC, but you lose the redundancy.

Type	`TXT`
Host / Name	`mail` The MAIL FROM subdomain you chose (shown here as mail.yourdomain.com).
Value / Content	`v=spf1 include:amazonses.com ~all`

SES Console → Verified identities → your domain → Custom MAIL FROM domain → set the subdomain.
Publish the MX record SES shows for that subdomain (feedback-smtp… — region-specific, copy it from the console) plus the TXT above.

DMARC

DMARC is per-domain, not per-provider — one record at _dmarc.yourdomain.com covers Amazon SES and everything else that sends as you. Start in monitor-only mode:

Type	`TXT`
Host / Name	`_dmarc` Some providers want the full _dmarc.yourdomain.com here.
Value / Content	`v=DMARC1; p=none; rua=mailto:your-report-address` Example only — replace your-report-address — our DMARC generator builds the record, or sign up free and we generate it with a report address that feeds your monitoring dashboard.

Provider note: Easy DKIM aligns out of the box. SPF only aligns after you set a custom MAIL FROM domain — do it and you have both.

Full walkthrough: how to set up DMARC without breaking your email, and why aligned authentication is what DMARC actually checks.

Verify it worked

After DNS propagates (minutes to an hour), send a message from Amazon SES to our inbox test — it shows the real SPF/DKIM/DMARC verdicts a receiver computes, including whether authentication aligned with your domain. Then HealthCheck Email keeps checking daily and alerts you when a record breaks.

Records current as of 2026-07-13. Provider dashboards change — the authoritative reference is Amazon SES's official docs.