Patchkit

Setup guide

Amazon SES: SPF, DKIM and DMARC

Easy DKIM gives you three CNAME records. A custom MAIL FROM subdomain makes SPF align with your domain.

DNS records to add

CNAMEHost<token1>._domainkey
<token1>.dkim.<region>.amazonses.comGet this value from your provider's dashboard.

Easy DKIM key 1

CNAMEHost<token2>._domainkey
<token2>.dkim.<region>.amazonses.comGet this value from your provider's dashboard.

Easy DKIM key 2

CNAMEHost<token3>._domainkey
<token3>.dkim.<region>.amazonses.comGet this value from your provider's dashboard.

Easy DKIM key 3

MXHost<mail-from subdomain>
10 feedback-smtp.<region>.amazonses.comGet this value from your provider's dashboard.

Custom MAIL FROM bounce handling

TXTHost<mail-from subdomain>
v=spf1 include:amazonses.com ~all

SPF for the MAIL FROM subdomain

Steps

  1. In the SES console open Identities → your domain → Authentication and copy the three Easy DKIM CNAME records.
  2. Under Custom MAIL FROM domain set a subdomain such as mail.yourdomain.com and publish the MX and TXT records SES shows.
  3. Wait for SES to show DKIM and MAIL FROM as verified.

Good to know

  • The SPF include goes on the MAIL FROM subdomain, not on your root domain.
  • The CNAME target's hosted-zone suffix depends on your AWS Region (for example dkim.eu-west-1.amazonses.com). Copy the exact value SES shows, don't assume amazonses.com alone.

Adding records at your DNS host

Cloudflare · Namecheap · GoDaddy · Amazon Route 53

Check your setup

After publishing, run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Amazon SES documentation.