Amazon SES Email Authentication: SPF, DKIM & DMARC

Amazon SES gives you the delivery mechanics and leaves authentication design to you. Out of the box, SES signs nothing and sends with a Return-Path on amazonses.com — SPF passes, but for Amazon's domain, not yours, so DMARC alignment fails until you publish the right records. Every Gmail, Yahoo and Microsoft bulk-sender requirement applies to SES traffic like any other.

With one console setting (Easy DKIM) plus a few DNS records, SES mail is fully authenticated, and an optional custom MAIL FROM domain adds SPF alignment on top of DKIM alignment. This guide covers both, plus when BYODKIM is worth it.

What you need

• An AWS account with Amazon SES, and a verified domain identity (SES console → Configuration → Identities).
• DNS access to the domain's zone — Route 53, Cloudflare or any provider.
• Your From domain settled. SES only needs DKIM on the domain in the From address; Return-Path and Reply-To domains do not need it.

Step 1: Enable Easy DKIM

In the SES console, open Configuration > Identities, choose your domain identity, and under the Authentication tab edit the DKIM settings. Choose Easy DKIM, set the key length to RSA_2048_BIT (the default for new identities), enable signatures, and save. SES generates three CNAME records:

CNAME  abcdef123456._domainkey.yourdomain.com  ->  abcdef123456.dkim.amazonses.com
CNAME  ghijkl789012._domainkey.yourdomain.com  ->  ghijkl789012.dkim.amazonses.com
CNAME  mnopqr345678._domainkey.yourdomain.com  ->  mnopqr345678.dkim.amazonses.com

Publish all three exactly as shown — the tokens are unique to your identity (Route 53 users can have SES create them with one click). Once they resolve, the console's DKIM status changes to Verified and every message from that identity is signed with d=yourdomain.com, satisfying DMARC's DKIM alignment on its own.

Step 2: Add a custom MAIL FROM domain (SPF alignment)

SPF is evaluated against the envelope sender (the MAIL FROM / Return-Path domain). SES's default envelope is a subdomain of amazonses.com, so SPF passes without aligning. For SPF alignment, configure a custom MAIL FROM domain — a subdomain of your verified domain, for example mail.yourdomain.com — in the identity's MAIL FROM settings, and publish two records on it:

mail.yourdomain.com.  TXT  "v=spf1 include:amazonses.com ~all"
mail.yourdomain.com.  MX   10 feedback-smtp.us-east-1.amazonses.com

The MX value depends on your AWS region — use the exact value the console shows. Because the custom MAIL FROM domain must be a subdomain of the From domain, alignment relies on the default relaxed mode — one more reason not to force strict alignment (aspf=s).

Step 3: Publish DMARC

DMARC is not managed by SES. Publish it yourself at the root of your From domain and start in monitoring mode:

_dmarc.yourdomain.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; fo=1"

Watch the reports for a few weeks, fix any other senders that fail, then escalate to quarantine and reject. Never jump straight to p=reject — every other service sending as your domain gets caught by the same policy.

When to use BYODKIM

Easy DKIM handles key storage for you. SES also supports BYODKIM (Bring Your Own DKIM): you generate the key pair, upload the private key and publish the public key as a TXT record. Use it when your security policy requires key custody or a specific selector. Keep the key at 2048 bits — BYODKIM accepts 1024–2048 bits, but 1024-bit keys are considered weak and rejected by some receivers.

Verify

Send a test message to Gmail and open Show original, or paste the headers into the Email Header Analyzer: you want SPF pass with the domain mail.yourdomain.com, DKIM pass with d=yourdomain.com, and DMARC pass. Cross-check with the DKIM Checker (use your console's selector token), the SPF Checker and the DMARC Lookup, or run everything at once with the Email Health Check. New to the protocols? Start with the authentication fundamentals guide.

Common mistakes

• Assuming SPF passes means DMARC passes. With the default envelope domain, SPF passes for amazonses.com and contributes nothing to DMARC. Alignment is what matters, and DKIM alignment is the minimum.
• Forgetting the region-specific records. If you send from multiple AWS regions, complete DKIM (and custom MAIL FROM) setup in each — one region's signature does not cover another.
• Missing MX on the custom MAIL FROM subdomain. Both the SPF TXT and the feedback MX are required; omitting the MX keeps the MAIL FROM domain pending.
• Publishing a second SPF record. The include:amazonses.com record goes on the custom MAIL FROM subdomain. If that subdomain already has SPF, merge into one record.
• Testing while in the sandbox. Sandbox accounts only send to verified addresses and hide deliverability problems. Move to production access before drawing conclusions.

Frequently asked questions

Do I need the custom MAIL FROM domain if DKIM already aligns?

No — DMARC passes when either aligned mechanism passes, and Easy DKIM alone satisfies that. The custom MAIL FROM domain is belt-and-braces: it adds SPF alignment too, which helps receivers that weigh both signals.

What key length does Easy DKIM use?

New identities default to 2048-bit RSA — keep them there; nothing in a normal setup requires a shorter key.

Does DKIM apply to subdomains of my verified domain?

Yes. DKIM attributes are inherited: Easy DKIM signs mail from subdomains too, unless you disable inheritance for a subdomain identity.

Can SES manage DMARC for me?

No. SES has no DMARC setting — the record is yours. Generate it with the DMARC Generator and analyze reports with the DMARC Report Analyzer.