emailsecops
Menu
Guides

Amazon SES SPF, DKIM and DMARC setup

Verify the domain with the three Easy DKIM CNAMEs that SES generates; DKIM then aligns with your From domain. Your root SPF record needs no change. For SPF alignment, add a custom MAIL FROM subdomain with an MX and an SPF record.

Transactional email API · reviewed October 13, 2026 against Amazon SES's documentation

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Amazon SES account: copy it from Amazon SES's setup screen, which shows the exact record.

ForTypeHostValue
DKIMEasy DKIM (default) CNAME {token1}._domainkey.{domain} {token1}.{signing-hosted-zone}{signing-hosted-zone} is dkim.amazonses.com in most Regions and dkim.{region}.amazonses.com in some; copy all three from SES.
DKIMEasy DKIM (default) CNAME {token2}._domainkey.{domain} {token2}.{signing-hosted-zone}
DKIMEasy DKIM (default) CNAME {token3}._domainkey.{domain} {token3}.{signing-hosted-zone}
DKIMBring your own key (BYODKIM) TXT {selector}._domainkey.{domain} p={public-key}Instead of Easy DKIM: a selector you choose and your own 1024- to 2048-bit RSA public key.
Bounces (MAIL FROM)Custom MAIL FROM domain optional MX {mail-from-subdomain}.{domain} priority 10 · feedback-smtp.{region}.amazonses.comExactly one MX on the MAIL FROM subdomain, which must not be a subdomain you send from or receive mail at.
SPFCustom MAIL FROM domain optional TXT {mail-from-subdomain}.{domain} v=spf1 include:amazonses.com ~allAWS shows the value in double quotes, which most DNS hosts need and some don't.
DMARC optional TXT _dmarc.{domain} v=DMARC1; p=none; rua=mailto:{report-address}SES recommends starting at p=none and tightening the policy in phases.

SPF

No change is needed at your root domain: by default SES uses a subdomain of amazonses.com as the MAIL FROM, so SPF passes for amazonses.com but can't align with your From domain. For SPF alignment, set up a custom MAIL FROM subdomain with an MX record and v=spf1 include:amazonses.com ~all; it aligns under relaxed SPF alignment, and aspf=s prevents it.

DKIM

Easy DKIM, the default, gives three CNAMEs whose tokens SES generates per identity and Region, pointing to keys SES hosts; they are 2048-bit RSA by default, 1024-bit selectable. With BYODKIM you publish your own 1024- to 2048-bit RSA key as a TXT record under a selector you choose, and rotate it yourself.

DMARC alignment

DKIM aligns once Easy DKIM or BYODKIM is verified for the From domain, because SES then signs with that domain. SPF aligns only with a custom MAIL FROM subdomain and relaxed SPF alignment; with the default amazonses.com MAIL FROM, only DKIM can align.

Common mistakes

  • Copy the DKIM CNAME targets from the SES console: the zone is dkim.amazonses.com in most Regions but dkim.{region}.amazonses.com in 11 Regions, and it can differ per identity.
  • Identities and Easy DKIM are per Region, so verify the domain with three new CNAMEs in every Region you send from, unless you use Deterministic Easy DKIM (DEED) replicas.
  • If the custom MAIL FROM MX record is missing or wrong, SES falls back to an amazonses.com MAIL FROM (losing SPF alignment) or rejects the mail, depending on the Behavior on MX failure setting.
  • A DMARC record with aspf=s prevents SPF alignment, because the SES MAIL FROM is always a subdomain.
  • While switching between Easy DKIM and BYODKIM, mail may go out unsigned until the new setup is verified, and the key length can change at most once every 24 hours.
  • DKIM record names need the underscore, and some DNS hosts append your domain to the name automatically.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

How EmailSecOps recognises Amazon SES

A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:

  • DKIM keys delegated (CNAME) to *.amazonses.com

Questions

What SPF record does Amazon SES need?+
No change is needed at your root domain: by default SES uses a subdomain of amazonses.com as the MAIL FROM, so SPF passes for amazonses.com but can't align with your From domain. For SPF alignment, set up a custom MAIL FROM subdomain with an MX record and v=spf1 include:amazonses.com ~all; it aligns under relaxed SPF alignment, and aspf=s prevents it.
What are the DKIM records for Amazon SES?+
Easy DKIM, the default, gives three CNAMEs whose tokens SES generates per identity and Region, pointing to keys SES hosts; they are 2048-bit RSA by default, 1024-bit selectable. With BYODKIM you publish your own 1024- to 2048-bit RSA key as a TXT record under a selector you choose, and rotate it yourself.
Does Amazon SES mail pass DMARC?+
DKIM aligns once Easy DKIM or BYODKIM is verified for the From domain, because SES then signs with that domain. SPF aligns only with a custom MAIL FROM subdomain and relaxed SPF alignment; with the default amazonses.com MAIL FROM, only DKIM can align.
Do I need a separate DMARC record for Amazon SES?+
No. A domain has one DMARC record, a TXT record at _dmarc.yourdomain.com, and it covers every service that sends as the domain. What each service needs is SPF or DKIM that aligns with your From domain; once every sender aligns, the policy can move from p=none to quarantine and then reject.

Sources