Lookproof Browse tools

DMARC, SPF and DKIM for Amazon SES

Updated 2026-11-07

Amazon SES (Amazon Simple Email Service) is a sending service: your application hands it messages, and SES delivers them. You verify your domain as an identity in the SES console and publish the DNS records yourself, unless Route 53 hosts your zone and SES publishes them for you. This guide follows the SES Developer Guide. For the background on each standard, see SPF explained, DKIM explained and DMARC explained.

What Amazon SES sends from

Every message has a visible From address and a MAIL FROM address, also called the envelope sender or Return-Path. The From address is your own domain, for example [email protected]. The MAIL FROM domain is not, unless you change it: "Messages that you send through Amazon SES automatically use a subdomain of amazonses.com as the default MAIL FROM domain." The exact subdomain is not printed; the docs only say it "varies based on the AWS Region that you use Amazon SES in."

SPF passes for that subdomain, so SES says "SPF is implicitly set up for you". But the domain belongs to Amazon, so SPF does not align with example.com. Aligned SPF needs a custom MAIL FROM domain, a subdomain of your own domain. This guide uses bounce.example.com; the name is your choice.

SES sets rules for it. It "has to be a subdomain of the parent domain of a verified identity", it "shouldn't be a subdomain that you also use to send email from", and it "shouldn't be a subdomain that you use to receive email."

SPF

With a custom MAIL FROM domain, you publish two records on the subdomain. As of November 2026 the console shows them in this format, with region replaced by your AWS Region (the docs give us-west-2, us-east-1 and eu-west-1 as examples):

bounce.example.com MX 10 feedback-smtp.eu-west-1.amazonses.com.
bounce.example.com TXT "v=spf1 include:amazonses.com ~all"

The MX record receives "the bounce and complaint notifications that email providers send you." SES is strict: "you must publish exactly one MX record to the DNS server of your MAIL FROM domain. If the MAIL FROM domain has multiple MX records, the custom MAIL FROM setup with Amazon SES will fail."

The TXT record goes on bounce.example.com, because receivers check SPF against the MAIL FROM domain. The SES docs do not ask you to add include:amazonses.com to the record on example.com, which still covers your other senders.

The record uses 1 DNS lookup itself. Amazon does not document a number for include:amazonses.com. When we counted it with real DNS on 7 November 2026, its record held only IP ranges, so it cost 1 lookup in total (the include itself) and nothing further. Amazon can change it, so check your tree with the SPF lookup counter. RFC 7208 sets the limit at 10 lookups. Above that, receivers return a permanent error and SPF fails (see too many SPF lookups).

The documented record ends in ~all (softfail). That is fine with DMARC: DMARC decides what happens to failing mail, not the all term.

DKIM

SES offers Easy DKIM, BYODKIM (your own key pair) and manual signing. This guide covers Easy DKIM, the console default: "the SES default setting which uses Easy DKIM with a 2048 bit signing length". With Easy DKIM, "SES generates a public-private key pair and automatically adds a DKIM signature to every message that you send from that identity".

You publish three CNAME records that SES generates. The docs describe the value as "the DKIM token followed by a hosted zone domain (for example, token.dkim.us-west-2.amazonses.com)", and the hosted zone "varies by AWS Region and identity." The records look like this, with token1 to token3 standing for the generated tokens:

token1._domainkey.example.com CNAME token1.dkim.us-west-2.amazonses.com.
token2._domainkey.example.com CNAME token2.dkim.us-west-2.amazonses.com.
token3._domainkey.example.com CNAME token3.dkim.us-west-2.amazonses.com.

Steps, based on the docs:

  • In the SES console, under Configuration, choose Identities and open the domain.
  • On the Authentication tab, check that Easy DKIM is enabled. Keep the key length at RSA_2048_BIT unless your DNS host only supports RSA_1024_BIT.
  • Expand Publish DNS records and copy the three CNAME records.
  • Add them at your DNS host, or let SES publish them if Route 53 hosts the zone.
  • Wait. "It can take up to 72 hours for changes to DNS settings to propagate." When SES finds all three, DKIM shows as Successful.

The docs do not print a sample DKIM-Signature header. The keys sit under _domainkey.example.com, so, by how DKIM works, the signature carries d=example.com.

Easy DKIM is set up per Region: "If you use more than one AWS Region to send email, you have to complete the DKIM setup process in each of those Regions".

DMARC alignment

DMARC passes when SPF or DKIM passes and the authenticated domain aligns with the From domain.

  • SPF alignment compares the MAIL FROM (Return-Path) domain with the From domain. With the default amazonses.com subdomain, it cannot align. SES notes that SPF alignment is rarely possible "when sending mail through third-party bulk email providers because the Return-Path (MAIL FROM) is used for bounces and complaints that the provider (SES) tracks using an address they own." With bounce.example.com as custom MAIL FROM domain, it aligns with example.com under relaxed alignment. SES says that "In order to achieve SPF alignment with SES, the domain's DMARC policy must not specify a strict SPF policy (aspf=s)."
  • DKIM alignment compares the d= domain with the From domain. Easy DKIM signs with keys under example.com, so a valid signature aligns. If your From address uses a subdomain such as news.example.com while DKIM signs as example.com, keep relaxed alignment (no adkim=s), as SES advises: "ensure that your DMARC policy is set to relaxed alignment".

Relaxed alignment is the default when your record has no aspf or adkim tag. Without a custom MAIL FROM domain, DMARC rests on DKIM alone. SPF adds a second path. SES warns that forwarding changes the envelope in a way that "invalidates SPF authentication", while DKIM "works even when a message has been forwarded between mail servers (as long as the message content has not been modified)." Set up both.

Step by step to p=reject

  1. Verify the domain with Easy DKIM. Create the domain identity in SES and publish the three DKIM CNAMEs from the console. Wait until DKIM shows as Successful.
  2. Set up a custom MAIL FROM domain. Choose an unused subdomain such as bounce.example.com. As of November 2026, publish one MX record to feedback-smtp.<region>.amazonses.com and the TXT record v=spf1 include:amazonses.com ~all on it. Wait until SES emails you that the setup succeeded; detecting the MX record can take up to 72 hours.
  3. Start DMARC at p=none with reports. Publish a TXT record at _dmarc.example.com with v=DMARC1; p=none; rua=mailto:[email protected]. This policy does not protect the domain yet; it only turns on aggregate reports.
  4. Read the reports and fix other senders. For two to four weeks, look at which servers send as your domain. Give every legitimate service SPF and, where it offers it, DKIM for your domain, so that its mail aligns too.
  5. Move to quarantine. Change the policy to p=quarantine once reports show only aligned mail from your own services. Failing mail is now usually placed in spam, so a sender you missed is still recoverable.
  6. Reject. Change the policy to p=reject when the reports stay clean. Receivers then refuse mail that fails DMARC.

The record for step 3:

_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"

The final record:

_dmarc.example.com TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"

The SES docs recommend the same order: start with "a simple monitoring-mode record" at p=none, then p=quarantine, and "Implementing a reject policy is usually the final step." Their example record uses p=quarantine; we read it as a syntax example, not a starting point.

Common mistakes

  • No custom MAIL FROM domain. SPF passes but never aligns, so DMARC depends on DKIM alone.
  • The SPF record on the wrong name. include:amazonses.com belongs on the MAIL FROM subdomain.
  • More than one MX record on the MAIL FROM subdomain. SES requires exactly one, or the setup fails.
  • A silent fallback. With "Use default MAIL FROM domain" as "Behavior on MX failure", SES goes back to the amazonses.com subdomain when the MX record is missing, and SPF stops aligning. The other option, "Reject message", returns a MailFromDomainNotVerified error instead. Pick on purpose.
  • Strict SPF alignment. With aspf=s in your DMARC record, SPF from bounce.example.com no longer aligns with example.com.
  • DKIM in only one Region. If you send from several AWS Regions, each needs DKIM set up, or some mail goes out unsigned (DKIM not found).
  • The domain typed twice, or an extra underscore. Some DNS hosts append the domain. SES also warns: "Do not add any additional underscores (_) at the beginning of the CNAME record names."
  • Two SPF records on one name. Receivers return a permanent error (multiple SPF records).
  • No rua address. Without rua you get no reports and cannot see other senders (DMARC without rua).
  • Relying on a test flag. Some receivers support a test flag: t=y in RFC 9989 (DMARCbis), which obsoletes RFC 7489, or pct in RFC 7489. Neither is a safety net. RFC 7489 says unknown tags must be ignored, so a receiver that implements only RFC 7489 can treat p=reject; t=y as a full reject, and receivers that follow RFC 9989 no longer use pct. Move from p=none to p=quarantine to p=reject and let the reports decide each step.

How to check it

Run the email security check on example.com and the SPF lookup counter on bounce.example.com. SES generates its DKIM selectors per identity, so the DKIM selector finder, which tries common names, will most likely report no common selectors. That does not mean DKIM is missing. Read the s= tag in the DKIM-Signature header of a message sent through SES instead. Build or check your policy with the DMARC record generator. The Return-Path header of the same message shows whether SES used your MAIL FROM domain.

Sources

Frequently asked questions

Does SPF align with DMARC on Amazon SES by default?

No. By default SES uses a subdomain of amazonses.com as the MAIL FROM domain. SPF passes for that domain, but it is not your domain, so it does not align with your From address. For aligned SPF you set up a custom MAIL FROM domain, such as bounce.example.com, with its own MX and SPF records.

What SPF record does Amazon SES document?

As of November 2026 the console shows v=spf1 include:amazonses.com ~all as a TXT record on your custom MAIL FROM subdomain, not on the domain itself. The same subdomain also needs one MX record that points at feedback-smtp.<region>.amazonses.com.

Which DKIM selectors does Easy DKIM use?

SES generates them for you. The console shows three CNAME records whose names end in ._domainkey.example.com and whose values point at a hosted zone under amazonses.com, for example token.dkim.us-west-2.amazonses.com. The tokens differ per identity and Region, so copy them from the console.

Is DKIM alone enough for DMARC with Amazon SES?

It is enough for a DMARC pass, because DMARC needs only one aligned method. Easy DKIM signs for your domain, so it aligns. A custom MAIL FROM domain adds aligned SPF as a second path, which SES describes as the way to use SPF, DKIM or both for DMARC.