Amazon SESSPF, DKIM & DMARC Setup
Amazon SES is a sending service, not a mailbox host — you don't point your domain's MX at it (unless you use SES inbound receiving). The key to DMARC-aligned SES mail is Easy DKIM plus a custom MAIL FROM domain.
Already set up? Check what your domain publishes right now — SPF, DKIM (three auto-generated tokens), DMARC, MX, BIMI, and MTA-STS in one scan.
Run a free domain check →1. SPF record
SPF for SES only aligns with your domain when you configure a custom MAIL FROM domain (e.g. mail.yourdomain.com) in SES — publish this record on THAT subdomain. Without custom MAIL FROM, SPF passes against amazonses.com and does not help your DMARC.
TXT record
v=spf1 include:amazonses.com ~all2. DKIM (selector: three auto-generated tokens)
SES console → Verified identities → your domain → DKIM (Easy DKIM, 2048-bit recommended). SES generates three CNAME records (<token>._domainkey.yourdomain.com → <token>.dkim.amazonses.com). Publish all three; status flips to 'Successful' after propagation.
3. MX records
No MX needed for sending. A custom MAIL FROM domain needs its own MX record (feedback-smtp.<region>.amazonses.com, priority 10) so bounces route back to SES.
4. DMARC record
DMARC passes via DKIM alignment (Easy DKIM signs with your domain). Publish DMARC on your root domain, start at p=none. If you also need SPF alignment, configure the custom MAIL FROM domain.
TXT record at _dmarc.yourdomain.com
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comAmazon SES authentication FAQ
SES mail passes SPF but fails DMARC — why?
Default SES envelope-from is amazonses.com, so SPF passes for Amazon's domain, not yours — no alignment. Fix: enable Easy DKIM (gives DKIM alignment, which alone satisfies DMARC) and optionally set a custom MAIL FROM domain for SPF alignment too.
Do I put include:amazonses.com on my root domain?
Only if you send from the root domain via other services too and want it documented. For DMARC purposes it belongs on your custom MAIL FROM subdomain — that's the domain SES uses in the envelope.
Official documentation: Amazon SES email authentication docs ↗
Verify your setup
DNS Email Diagnostics
SPF, DKIM, DMARC, MX, BIMI & MTA-STS in one check
MX Record Lookup
See exactly which mail servers your domain publishes
BIMI Validator
Show your logo in Gmail & Yahoo once DMARC is enforced
Deliverability Monitoring
Daily checks + email alerts when a record changes or breaks