Blog
Configure Amazon SES SPF, DKIM and DMARC
Reviewed by the Free Domain Mail editorial team · Updated
Amazon SES can sign outgoing mail, but domain authentication still depends on publishing the exact DNS records for the verified identity and aligning the visible From domain.
Verify the sending identity
Verify the domain in the same SES region used by the application. Publish all Easy DKIM CNAME records exactly as supplied.
Use a custom MAIL FROM domain when aligned SPF is required, and keep its MX and SPF records separate from the root receiving MX.
Add DMARC after SPF and DKIM
Publish DMARC at _dmarc with p=none first and collect aggregate reports.
Move toward quarantine or reject only after every legitimate sender passes aligned SPF or DKIM.
Common mistakes to avoid
- Changing production DNS before recording the current values.
- Assuming a DNS record guarantees inbox placement.
- Testing before the previous TTL has expired.
Frequently asked questions
Does SES require an SPF record at the root?
Not always. SES can pass DMARC through aligned DKIM; custom MAIL FROM uses its own SPF record.
Why are there three DKIM records?
Easy DKIM publishes multiple selectors so AWS can rotate signing keys safely.
Technical references
Primary specifications and provider documentation relevant to this guide: