Guide · Amazon SES
Amazon SES DKIM, SPF and DMARC setup
Short answer
For Amazon SES DKIM, SPF and DMARC: turn on Easy DKIM on your domain identity and publish its three CNAME records. Set a custom MAIL FROM subdomain with one MX record and one SPF TXT record, so SPF aligns with your From domain. Then publish _dmarc.yourdomain.com as TXT v=DMARC1; p=none; rua=mailto:[email protected]. That covers the authentication part of the Gmail and Yahoo bulk sender rules.
By BYOMailer · Updated 2026-11-06 · Facts checked against the official docs in November 2026
What each record does on SES
Three records, three jobs. DKIM signs every message with your domain, and the signature survives forwarding. SPF says which servers may send for your MAIL FROM (Return-Path) domain. DMARC checks that at least one of them passes and matches the From address your reader sees, and tells inboxes what to do when neither does.
The catch on SES: out of the box, SPF passes for a subdomain of amazonses.com, not for your domain. It passes, but it does not align. That is why step 3 exists.
Step 1Create or open your domain identity
In the SES console, open Configuration → Identities. Create an identity of type Domain, or pick the one you already have. Identities are per region, so do this in the region you send from.
Step 2Turn on Easy DKIM
On the identity, open the Authentication tab and edit DomainKeys Identified Mail (DKIM). Choose Easy DKIM, keep RSA_2048_BIT (the default), check Enabled, and save. SES then signs every email from the domain with a 2048-bit key.
SES shows three CNAME records. They look like this:
| Name | Type | Value |
|---|---|---|
| token1._domainkey.example.com | CNAME | token1.dkim.<region>.amazonses.com |
| token2._domainkey.example.com | CNAME | token2.dkim.<region>.amazonses.com |
| token3._domainkey.example.com | CNAME | token3.dkim.<region>.amazonses.com |
Copy the exact values from the console, because the hosted zone part changes by region and identity. Do not add an extra underscore at the start of the name: it is abc123._domainkey.example.com, not _abc123._domainkey.example.com. On Route 53 in the same account, SES can publish the records for you.
DNS can take up to 72 hours. When SES sees all three, DKIM shows Successful and the identity shows Verified.
Step 3Set a custom MAIL FROM domain for SPF alignment
On the same identity, find Custom MAIL FROM domain and choose Edit. Check Use a custom MAIL FROM domain and enter a subdomain, for example mail.example.com. The rules from AWS: it must be a subdomain of your verified domain, and it should not be a subdomain you send from or receive mail on.
For Behavior on MX failure, "Use default MAIL FROM domain" keeps mail flowing on amazonses.com if your MX record breaks. "Reject message" stops the send with a MailFromDomainNotVerified error instead. Then publish two records:
| Name | Type | Value |
|---|---|---|
| mail.example.com | MX | 10 feedback-smtp.<region>.amazonses.com |
| mail.example.com | TXT | "v=spf1 include:amazonses.com ~all" |
The MX record is how inboxes return bounces and complaints to SES. Publish exactly one MX record on this subdomain. If there are more, the setup fails. SES emails you when it finds the records, which can take up to 72 hours.
You do not need to add amazonses.com to the SPF record on your root domain for SES. Inboxes check SPF on the MAIL FROM domain, and that is this subdomain.
Step 4Publish a DMARC record that starts at p=none
Add one TXT record at _dmarc on the domain you send from:
| Name | Type | Value |
|---|---|---|
| _dmarc.example.com | TXT | "v=DMARC1; p=none; rua=mailto:[email protected]" |
p=none is monitoring mode. Nothing gets blocked, and inboxes send aggregate reports to the rua address, usually once a day. AWS recommends exactly this as the first step for an existing domain, so you can see which senders pass before you enforce anything. Gmail and Yahoo both accept p=none for their bulk sender rules.
Step 5Check SPF and DKIM alignment
First, read your DMARC record and look at the alignment tags:
dig TXT _dmarc.example.com +short
# "v=DMARC1; p=none; rua=mailto:[email protected]"
# No aspf= or adkim= tag means relaxed alignment for both.- SPF alignment through SES needs relaxed SPF alignment. If you see
aspf=s, remove it. No tag means relaxed. - DKIM alignment: Easy DKIM signs with your domain, so it matches a From address on that domain. If you send from a subdomain, keep
adkimrelaxed (no tag, oradkim=r).
Then send a real email to an inbox you own and open the full headers. You want all three passes, with your own domain on each line:
Authentication-Results: mx.example.net;
dkim=pass header.d=example.com;
spf=pass smtp.mailfrom=mail.example.com;
dmarc=pass header.from=example.com If spf=pass shows an amazonses.com domain, the custom MAIL FROM is not active yet. If dkim shows amazonses.com instead of your domain, Easy DKIM is not verified yet.
Step 6Move to quarantine, then reject
Read the DMARC reports for a while. When your real mail passes, change the record to p=quarantine (failing mail goes to spam). After that, p=reject (failing mail is refused). AWS says to do each step on your subdomains first and on the top domain last. The wrong policy too early can stop your own email from arriving.
The Gmail and Yahoo bulk sender rules
Since February 2024, Gmail and Yahoo enforce sender requirements. Gmail's bulk rules apply when you send 5,000 or more messages a day to Gmail accounts. A newsletter crosses that fast.
| Rule | All senders | Bulk senders |
|---|---|---|
| Authentication | SPF or DKIM | SPF and DKIM |
| DMARC | Recommended | Required, p=none is enough |
| From alignment | Not required | From domain aligned with the SPF or DKIM domain |
| Spam rate | Below 0.3% | Below 0.3%. Gmail recommends below 0.1% |
| Unsubscribe | Easy to unsubscribe | One-click (RFC 8058) plus a visible link. Yahoo: honor within 2 days |
| Infrastructure | Valid forward and reverse DNS, TLS | Valid forward and reverse DNS, TLS |
Sources: Google Email sender guidelines and Yahoo Sender best practices, checked November 2026. One-click unsubscribe means both List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click headers.
How BYOMailer handles this step for you
You still own the DNS, so you still paste the records. BYOMailer does the SES side and tells you exactly what to paste:
- When you add a sending domain, BYOMailer creates the identity in your own SES account with DKIM on, and sets a custom MAIL FROM subdomain (
mas.yourdomain.comunless you pick another). - It lists every record to publish in one place: the DKIM CNAMEs, the MAIL FROM MX and SPF records, and a
v=DMARC1; p=none;record. - It re-checks your DNS every 15 minutes, including the DMARC policy you actually published.
- Campaign emails carry the one-click
List-Unsubscribeheaders that Gmail and Yahoo ask for.
Click tracking adds one more domain to your links. To keep it on your own domain, see Custom tracking domain in the docs. Not in production yet? Start with getting out of the SES sandbox. For the cost side, try the SES savings calculator or read about email marketing on Amazon SES.
Frequently asked questions
Do I need SPF if Amazon SES already signs with DKIM?
DMARC passes with one aligned method, so DKIM alone can pass. But Yahoo requires both SPF and DKIM for bulk senders, and Gmail requires both for senders of 5,000 or more messages a day to Gmail accounts. A custom MAIL FROM domain gives you aligned SPF too.
Why does SPF not align on Amazon SES by default?
By default SES uses a subdomain of amazonses.com as the MAIL FROM (Return-Path) domain. SPF passes for that domain, but it does not match your From domain, so it does not count for DMARC. A custom MAIL FROM subdomain of your own domain fixes that.
Which DMARC policy should I start with?
Start with p=none and a rua address so you get aggregate reports without blocking any mail. AWS recommends moving to p=quarantine and then p=reject only after the reports show your legitimate mail is aligned.
How long does SES DKIM verification take?
DNS changes can take up to 72 hours to propagate. As soon as SES detects all DKIM records, the DKIM configuration shows Successful and the identity shows Verified. SES can take up to 72 hours to detect the MAIL FROM MX record too.
Should I pick a 2048-bit or 1024-bit DKIM key?
SES defaults to 2048 bits, and AWS says 2048 is always preferred. Use 1024 only if your DNS provider cannot store a 2048-bit key. You cannot switch key length more than once in 24 hours.
Can I use my root domain as the MAIL FROM domain?
No. The MAIL FROM domain has to be a subdomain of your verified domain. AWS says it should not be a subdomain you send from or receive mail on, and it must have exactly one MX record.
Keep exploring