Setup Guides · Amazon SES

Amazon SES Authentication Setup: SPF, DKIM & DMARC

Q: What DNS records does Amazon SES need for authentication?

For DKIM, Easy DKIM generates three CNAME records ( ._domainkey.yourdomain.com pointing to .dkim.amazonses.com) that you publish to verify the domain identity and sign mail with d=yourdomain.com. For SPF alignment you optionally add a custom MAIL FROM subdomain, which needs one MX record (feedback-smtp. .amazonses.com, priority 10) and one SPF TXT record (v=spf1 include:amazonses.com ~all). SES does not create a DMARC record for you - you publish _dmarc.yourdomain.com yourself.

Q: Does Amazon SES set up SPF and DMARC for me?

Not the way SES handles DKIM. By default SES uses a subdomain of amazonses.com as the MAIL FROM, so SPF passes but does not align with your From domain for DMARC. To get SPF alignment you configure a custom MAIL FROM subdomain (an MX + SPF TXT record). And SES never creates a DMARC record - you must publish _dmarc.yourdomain.com yourself. Easy DKIM is the only part SES helps you generate.

Q: Why does my SES mail pass DMARC even without SPF alignment?

DMARC passes if either SPF or DKIM aligns. With Easy DKIM, SES signs with d=yourdomain.com, which strictly aligns with your From domain, so DMARC passes on DKIM alone - no custom MAIL FROM required. Adding a custom MAIL FROM gives you SPF alignment as well, which is belt-and-braces: if DKIM ever breaks (for example a truncated key), aligned SPF still carries DMARC.

Q: Easy DKIM or BYODKIM - which should I use?

Use Easy DKIM unless you have a specific reason not to. Easy DKIM has SES generate and rotate a 2048-bit key (1024 is selectable for DNS hosts that need it) and you publish three CNAME records. BYODKIM (Bring Your Own DKIM) uses a single TXT record with a key pair you generate and a selector you choose - useful when you must control or rotate the key yourself, or reuse the same key across providers.

Q: Why can Amazon SES only send to verified addresses?

Because your account is in the SES sandbox, which every new account (per AWS Region) starts in. In the sandbox you can only send to verified identities, at up to 200 messages per 24 hours and 1 per second. Request production access from the SES account dashboard (choose transactional or marketing, add your website and use case); AWS usually responds within 24 hours. Verify your domain first - it helps approval.

Q: Which AWS region goes in the SES MAIL FROM MX record?

The region you send from. The custom MAIL FROM MX must point to feedback-smtp. .amazonses.com - for example feedback-smtp.us-east-1.amazonses.com - and there must be exactly one MX record on that subdomain. Point it at the wrong region and SES never detects it, so the MAIL FROM setup fails and SPF alignment is silently lost. The SPF include (amazonses.com) is not region-specific; only the MX endpoint is.

Amazon SES makes DKIM easy and leaves the rest to you. Easy DKIM hands you three CNAME records that verify your domain and sign mail with d=yourdomain.com, which is enough to pass DMARC on its own. But SPF only aligns if you add a custom MAIL FROM domain, and - unlike some providers - SES never creates your DMARC record. This guide is the exact records, the SES-specific gotchas (the region in the MAIL FROM MX, the sandbox), and the failures we keep finding in audits.

Last updated 10 September 2026 · applies to Amazon SES (all regions)

What SES authenticates for you (and what it does not)

DKIM - SES does this for you. Easy DKIM generates the keys and the records; SES signs with d=yourdomain.com, so DKIM aligns with your From domain and DMARC passes.
SPF - only if you opt in. By default SES sends with a MAIL FROM (Return-Path) under amazonses.com. SPF passes, but it does not align with your From domain, so it does not help DMARC. A custom MAIL FROM subdomain fixes that.
DMARC - entirely yours. SES does not generate or publish a DMARC record. You add _dmarc.yourdomain.com yourself.

The upshot: DKIM alone gets you a DMARC pass, but a complete, resilient setup is Easy DKIM + a custom MAIL FROM + your own DMARC record. And nothing sends to real recipients until you leave the sandbox.

What you need

An AWS account with access to the Amazon SES console, in the region you will send from (SES is regional - identities, DKIM and sandbox status are per-region).
Access to your domain's public DNS. If the domain is hosted in Route 53 under the same AWS account, SES can publish the records for you.

The setup, step by step

1 Create a domain identity with Easy DKIM

In the SES console go to Configuration → Identities → Create identity → Domain, enter your domain, and keep Easy DKIM selected with a 2048-bit signing key (1024 is only for DNS hosts that cannot handle 2048). SES generates the DKIM records; the identity Status becomes Verified once it detects them.

2 Publish the three Easy DKIM CNAME records

SES gives you three CNAME records, each with a unique token:

Type   Host                                  Value
CNAME  [token1]._domainkey.yourdomain.com     [token1].dkim.amazonses.com
CNAME  [token2]._domainkey.yourdomain.com     [token2].dkim.amazonses.com
CNAME  [token3]._domainkey.yourdomain.com     [token3].dkim.amazonses.com

Publish all three - a partial set leaves DKIM unverified. Copy the exact values SES shows you.

Check the DKIM target for your region

In most regions the target is dkim.amazonses.com as shown, but AWS notes a few regions use a region-specific DKIM domain. Always publish the exact target from your SES console rather than assuming dkim.amazonses.com. (BYODKIM is the alternative: one TXT record with a key you generate and a selector you choose - use it only if you need to control the key yourself.)

3 Add a custom MAIL FROM (for SPF alignment)

On the verified identity, open Custom MAIL FROM domain → Edit, enter a subdomain of your domain (for example mail.yourdomain.com), and publish the two records SES shows - an MX and an SPF TXT:

Type   Host                    Value
MX     mail.yourdomain.com     10 feedback-smtp.[region].amazonses.com
TXT    mail.yourdomain.com     "v=spf1 include:amazonses.com ~all"

The MX endpoint is region-specific - use your sending region (e.g. feedback-smtp.us-east-1.amazonses.com) - and there must be exactly one MX record on that subdomain. The SPF include:amazonses.com is not region-specific. For "behavior on MX failure", Use default MAIL FROM domain is the safe choice (SES falls back to amazonses.com if the MX ever breaks, rather than rejecting your mail).

4 Publish your own DMARC record

SES will not do this for you. Add a TXT record at _dmarc.yourdomain.com, starting in monitoring mode:

Type  Host                    Value
TXT   _dmarc.yourdomain.com   v=DMARC1; p=none; rua=mailto:[email protected]

Collect the aggregate reports, confirm your SES mail (and every other sender) passes aligned, then move the policy through p=quarantine to p=reject. Our DMARC enforcement guide walks that path - including the current DMARCbis tags (np= for subdomains, and why pct= is being retired) - and the Postbox DMARC Monitor reads the reports for you.

5 Leave the sandbox (request production access)

Every new SES account starts in the sandbox (per region): you can only send to verified addresses, capped at 200 messages / 24 hours and 1 / second. From the SES Account dashboard, choose Request production access, pick transactional or marketing, and describe your use case. AWS usually responds within 24 hours; having your domain verified first helps.

How SPF, DKIM and DMARC line up here

DKIM - Easy DKIM signs with d=yourdomain.com, and SES uses strict DKIM alignment by default, which matches your From domain exactly. This alone makes DMARC pass.
SPF - without a custom MAIL FROM, the Return-Path is amazonses.com: SPF passes but is not aligned, so it does nothing for DMARC. With a custom MAIL FROM subdomain, SES uses relaxed SPF alignment (the subdomain shares your organizational domain), so SPF aligns too.
DMARC - passes when either SPF or DKIM aligns. With Easy DKIM that is satisfied immediately; the custom MAIL FROM adds SPF alignment as a second, independent path. See our SPF, DKIM and DMARC guide for how the three fit together, and note that a strict aspf=s or adkim=s in your DMARC record can undo SES's default relaxed-SPF / strict-DKIM behaviour.

Dedicated vs shared IP, and reverse DNS

By default SES sends from shared IPs that Amazon owns and maintains reverse DNS for - fine for most senders, nothing to configure. For high or sensitive volume you can use dedicated IPs (standard or managed); with standard dedicated IPs the reputation is yours to warm, and if you set a custom PTR you must configure forward-confirmed reverse DNS - the IP's PTR resolves to a hostname, and that hostname's A/AAAA record resolves back to the same IP - or Gmail can reject with 550 5.7.25, the RFC-standard enhanced code for reverse-DNS validation failure (see our SMTP error codes reference). Most SES senders should start on shared IPs and only move to dedicated once volume justifies the warmup.

The failures we keep finding

Assuming SPF alignment without a custom MAIL FROM

SES mail on the default amazonses.com MAIL FROM shows SPF pass in headers, which looks fine - but it is not aligned, so it contributes nothing to DMARC. DKIM carries you here; if DKIM ever breaks you have no SPF fallback. Add a custom MAIL FROM so both paths align.

The MAIL FROM MX points at the wrong region

The MX must be feedback-smtp.<your-region>.amazonses.com. A copy-pasted us-east-1 when you send from eu-west-1 means SES never detects it, the MAIL FROM setup goes to Failed, and it silently falls back to amazonses.com - SPF alignment lost with no error in your inbox.

More than one MX on the MAIL FROM subdomain

SES requires exactly one MX record on the MAIL FROM subdomain. If that subdomain already has an MX (for example from WorkMail or another service), setup fails. Use a dedicated subdomain with only the SES MX.

Expecting SES to publish DMARC

It never does. A domain with Easy DKIM but no _dmarc record has no DMARC policy at all, which fails the Gmail and Yahoo bulk-sender rules. Publish your own, starting at p=none.

Publishing only some of the DKIM CNAMEs, or verifying too early

All three CNAMEs must resolve, and SES can take up to 72 hours to detect DNS changes. A partial set or an impatient check leaves the identity Pending - wait for propagation before assuming something is wrong.

Still in the sandbox

Mail to unverified recipients silently fails and you are capped at 200/day. If "it works to my own address but not to customers", you never requested production access.

Verify it end to end

The SES console shows the identity as Verified and MAIL FROM as Success, but that only means the records exist. Prove real mail authenticates:

Send a test through SES to Postbox Mailtester and confirm DKIM pass with d=yourdomain.com, DMARC pass (aligned), and - if you set a custom MAIL FROM - SPF aligned too.
Or read the received message's Authentication-Results header: dkim=pass header.d=yourdomain.com and dmarc=pass. If DKIM shows d=amazonses.com, Easy DKIM is not active on this identity - go back to step 1.

Frequently asked questions

What DNS records does Amazon SES need for authentication?

For DKIM, Easy DKIM generates three CNAME records (<token>._domainkey.yourdomain.com → <token>.dkim.amazonses.com) that verify the domain and sign with d=yourdomain.com. For SPF alignment you optionally add a custom MAIL FROM subdomain - one MX (feedback-smtp.<region>.amazonses.com, priority 10) and one SPF TXT (v=spf1 include:amazonses.com ~all). SES does not create a DMARC record; you publish _dmarc.yourdomain.com yourself.

Does Amazon SES set up SPF and DMARC for me?

No. SES uses a subdomain of amazonses.com as the default MAIL FROM, so SPF passes but does not align for DMARC - add a custom MAIL FROM to align it. And SES never creates a DMARC record; publish _dmarc yourself. Easy DKIM is the only part SES generates for you.

Why does my SES mail pass DMARC even without SPF alignment?

DMARC passes if either SPF or DKIM aligns. Easy DKIM signs with d=yourdomain.com, which strictly aligns, so DMARC passes on DKIM alone. A custom MAIL FROM adds SPF alignment as a second independent path - useful if DKIM ever breaks.

Easy DKIM or BYODKIM - which should I use?

Use Easy DKIM unless you have a reason not to: SES generates and rotates a 2048-bit key and you publish three CNAMEs. BYODKIM uses a single TXT record with a key pair and selector you control - for when you must own or rotate the key yourself, or reuse one key across providers.

Why can Amazon SES only send to verified addresses?

Your account is in the SES sandbox (every new account, per region): sending is limited to verified identities, 200 messages / 24 hours and 1 / second. Request production access from the SES account dashboard; AWS usually responds within 24 hours.

Which AWS region goes in the SES MAIL FROM MX record?

The region you send from - feedback-smtp.<region>.amazonses.com (e.g. feedback-smtp.us-east-1.amazonses.com), with exactly one MX record. Wrong region = SES never detects it and SPF alignment is silently lost. The SPF include is not region-specific.

Sources (AWS SES Developer Guide): Easy DKIM · BYODKIM · Custom MAIL FROM · SPF · DMARC · Request production access · Troubleshoot DKIM.

Not sure your SES mail is actually aligned?

Test it with Postbox Mailtester Talk to a deliverability expert