SPF record for Amazon SES

Amazon SES sends everything from application mail to bulk campaigns. To send that mail as your domain and pass DMARC, publish the records below and check the alignment notes.

The SPF record

You need this on whichever domain ends up as the envelope sender. If you leave the default MAIL FROM in place, the envelope sender is on Amazon's own domain and your root record doesn't need the include at all. If you configure a custom MAIL FROM domain, which you should, the include goes on that subdomain.

The include is:

Count your lookups after any change, because SPF allows ten DNS lookups across the whole chain of includes. A sender that receivers need an eleventh lookup to find gets a permerror and fails SPF. Our free SPF checker follows every include and gives you the count. It also shows whether Amazon SES needs the include on the domain you check.

DKIM

Easy DKIM gives you three CNAME records with generated tokens, all of the same shape:

Publish all three. SES rotates keys behind them, so this is set-and-forget. If you have a compliance reason to hold your own private key, SES supports bring-your-own DKIM instead, and then you own rotation.

Return path and SPF alignment

Configure a custom MAIL FROM subdomain so SPF aligns. It takes two records on the subdomain, with the region matching your SES region:

The MX is how SES receives bounces for that domain. If you get the region wrong, verification stays pending and SES gives no reason.

DMARC alignment with Amazon SES

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain while your mail fails DMARC.

• New accounts are in the sandbox and can only send to verified addresses. That's a sandbox limit, though it looks like an authentication problem at first.
• Without a custom MAIL FROM, SPF authenticates amazonses.com and only DKIM aligns. That's enough for DMARC. It also means a DKIM problem at SES leaves you with nothing aligned.
• SES rewrites links for open and click tracking before it signs, so the signature still verifies. A gateway that rewrites them again after signing causes a body hash failure.

The DMARC alignment guide covers the general case, and the dmarc=fail page shows how to read the Authentication-Results header.

Verification

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Amazon SES to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. A test message shows what a receiver does with your mail. A DNS lookup only shows what you published.

Our SPF checker gives you the lookup count. The DKIM checker shows whether a selector resolves and whether the key is long enough, and the DMARC checker reads your policy back to you. You can use them free, without an account.

I checked the values here against Amazon SES's own documentation, at AWS SES developer guide. Providers change their DNS requirements without much notice. If their screen shows something different from this page, follow their screen and tell us.

A record can be correct and still fail alignment once real mail goes through it. Receivers record that result in the reports they send. We read the reports for you, and on a paid plan we email you the day a new sender fails. See whether this sender passes. Your first domain is free.