Tencent Cloud SES: SPF, DKIM & DMARC Setup

Tencent Cloud Email Service (SES) refuses to send from a domain until you prove you control it and publish the authentication records it expects. Unlike a mailbox product, SES is a sending API: no inboxes, only sender domains, sender addresses and templates. Authentication is therefore the whole onboarding process.

The console generates the values; you publish them at your DNS provider. This walkthrough covers a primary domain, the subdomain variant, and the queries Tencent documents for verification.

What you need

• An activated SES service, with a verified account.
• DNS control for the domain, either DNSPod or a third-party provider.
• A domain not already registered to Tencent Exmail; those cannot be SES sender domains.
• One of the ten sender domains each account may configure.

Step 1: create the sender domain

Open the SES console and go to Sender Domain. Click Create, enter the domain and submit. A bare yourdomain.com is primary; mail.yourdomain.com is non-primary, and every host record drops the suffix accordingly.

Click Verify; a panel lists the record values for your domain. Those are authoritative — copy them from the console, not this article.

Step 2: publish MX, SPF and DKIM

For a primary domain the record set looks like this. Use ip4, never ipv4, in any SPF you extend by hand, and keep one SPF record at the root.

@        MX    mxbiz1.qq.com.                    priority 5
@        TXT   v=spf1 include:qcloudmail.com ~all
qcloudsg2048._domainkey  TXT  v=DKIM1; k=rsa; p=MIIBIjANBg...
_dmarc   TXT   v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Details that cause failed verification:

• The MX value needs its trailing dot. Tencent documents mxbiz1.qq.com. with the dot; some providers add it automatically, others do not, and without it the value becomes a relative name.
• The SPF include is qcloudmail.com, not the Exmail include. If you also send through another provider, merge the includes into the same record: v=spf1 include:qcloudmail.com include:spf.example.com ~all. Never publish a second v=spf1 record.
• Choose the 2048-bit DKIM selector. New domains use qcloudsg2048._domainkey for 2048-bit keys and qcloudsg1024._domainkey for 1024-bit keys. Domains created before 6 July 2026 still use qcloud._domainkey, so check the console rather than assuming. The international endpoint (ap-singapore) uses the qcloudsg prefix; the mainland endpoints use qcloudgz2048 (Guangzhou) and qcloudhk2048 (Hong Kong) respectively — always copy the host name shown in your own console. Select 2048-bit; 1024-bit only suits DNS providers that cannot store a long TXT value.

For a non-primary domain such as mail.yourdomain.com, the hosts become mail for MX and SPF, _dmarc.mail for DMARC and qcloudsg2048._domainkey.mail for DKIM.

Step 3: verify with dig before clicking Verify

Propagation takes five minutes to two hours. Rather than refreshing the console, query directly:

dig mx +short yourdomain.com
dig txt +short yourdomain.com
dig txt +short _dmarc.yourdomain.com
dig txt +short qcloudsg2048._domainkey.yourdomain.com

Compare each answer with the values on the page, then click Submit. Status becomes Verified when all four types match.

Step 4: publish a DMARC policy you can live with

SES shows a DMARC example, but the policy is yours. Begin with monitoring and a real reporting mailbox:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1

Keep it at p=none for two to four weeks. Reports show which shared IPs send for you and whether alignment holds. Then move to p=quarantine; pct=25 and finally p=reject. Publishing reject on day one is a reliable way to lose transactional mail.

If you also use Tencent Exmail

Tencent Exmail is the mailbox product and uses a different include: v=spf1 include:spf.mail.qq.com ~all, with MX at mxbiz1.qq.com and mxbiz2.qq.com on priorities 5 and 10. Because Exmail domains cannot be registered as SES sender domains, keep the two on separate names: root for mailboxes, a subdomain for SES. That also isolates sending reputation.

Verify from the receiving side

Send a test through the SES API or console to a Gmail mailbox you own and open Show original. Expect spf=pass with a Tencent IP, dkim=pass header.d=yourdomain.com and dmarc=pass. Externally, check the records with the SPF Checker, the DKIM Checker using selector qcloudsg2048, the DMARC Lookup and MX Lookup. If messages are accepted but land in spam, run the Email Deliverability Test and the Blacklist Checker.

Common mistakes

1. Using the Exmail SPF include for SES. spf.mail.qq.com authorizes mailboxes, not the SES sending fleet. SES needs qcloudmail.com.
2. Picking the wrong DKIM host. Domains created before 6 July 2026 use qcloud._domainkey; newer ones use the 2048 or 1024 selector. Verify against the console.
3. Dropping the MX trailing dot. The reply-address MX must be fully qualified.
4. Adding a second SPF record for another vendor. Merge the include into the existing record instead.
5. Treating verification as the finish line. A verified domain with p=none and no reporting address gives you no visibility into spoofing.

Frequently asked questions

Can I use an existing Exmail domain with SES?

No. A domain registered to Tencent Exmail cannot be added as an SES sender domain. Register a subdomain such as mail.yourdomain.com for SES and keep the root domain on Exmail.

Should I publish both 1024-bit and 2048-bit DKIM records?

Only if you are migrating a live domain and need continuity while the 2048-bit key propagates. For a new domain, publish 2048-bit only — 1024-bit keys are weak and some receivers discount them.

Why is my domain still unverified after adding all records?

Propagation may not be finished — Tencent allows five minutes to two hours — or one value differs by a character. Run the four dig queries and compare line by line.

Does SES sign with its own domain?

No. DKIM signatures use your sender domain, which is why alignment with your From header works. If you spoof the From address to a domain you have not verified, SES rejects the send rather than signing it.