Setup guide
Amazon SES: SPF, DKIM and DMARC
Easy DKIM gives you three CNAME records. A custom MAIL FROM subdomain makes SPF align with your domain.
By Ahmet Karaca · Updated · Checked against Amazon SES documentation on
DNS records to add
<token1>._domainkey<token1>.dkim.<region>.amazonses.comReplace the part in angle brackets with your own value before publishing.
Easy DKIM key 1
<token2>._domainkey<token2>.dkim.<region>.amazonses.comReplace the part in angle brackets with your own value before publishing.
Easy DKIM key 2
<token3>._domainkey<token3>.dkim.<region>.amazonses.comReplace the part in angle brackets with your own value before publishing.
Easy DKIM key 3
<mail-from subdomain>10 feedback-smtp.<region>.amazonses.comReplace the part in angle brackets with your own value before publishing.
Custom MAIL FROM bounce handling
<mail-from subdomain>v=spf1 include:amazonses.com ~allSPF for the MAIL FROM subdomain
Steps
- In the SES console open Identities → your domain → Authentication and copy the three Easy DKIM CNAME records.
- Under Custom MAIL FROM domain set a subdomain such as mail.yourdomain.com and publish the MX and TXT records SES shows.
- Wait for SES to show DKIM and MAIL FROM as verified.
Common mistakes
- With Behavior on MX failure set to Use default MAIL FROM domain, a broken MX record makes SES fall back to an amazonses.com subdomain, so SPF stops aligning with your From domain.
- Publishing more than one MX record on the MAIL FROM subdomain makes the custom MAIL FROM setup fail. SES requires exactly one.
- Adding a leading underscore, such as _abc123._domainkey, breaks Easy DKIM. Use the record names exactly as the SES console shows them.
- Switching an identity from BYODKIM to Easy DKIM can send mail with no DKIM signature while Easy DKIM is pending. AWS suggests migrating through a subdomain or during downtime.
Good to know
- The SPF include goes on the MAIL FROM subdomain, not on your root domain.
- The CNAME target's hosted-zone suffix depends on your AWS Region (for example dkim.eu-west-1.amazonses.com). Copy the exact value SES shows, don't assume amazonses.com alone.
Frequently asked questions
How long does SES keep looking for my MAIL FROM MX record?
72 hours, after which SES marks the custom MAIL FROM setup Failed. DNS changes themselves can also take up to 72 hours to propagate.
Do I need to verify my domain in every AWS Region?
Yes. To send from the same domain in more than one Region, create and verify a separate identity in each, because the verification records differ by Region.
Do subdomains need their own SES identity?
No. A verified domain identity lets you send from any subdomain or address under it. Verify a subdomain separately only if it needs its own settings.
What key length does Easy DKIM use?
2048-bit by default, with 1024-bit available if your DNS provider only supports it. You can't change the key length more than once in 24 hours, except for a first downgrade to 1024.
Adding records at your DNS host
Check your setup
After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Amazon SES documentation.
Check your Amazon SES setup
Or open the SPF checker, DKIM checker or DMARC checker directly.