Amazon SES can sign outgoing mail, but domain authentication still depends on publishing the exact DNS records for the verified identity and aligning the visible From domain. This checklist covers the three parts in the order that avoids breaking delivery: Easy DKIM, a custom MAIL FROM domain for aligned SPF, and DMARC. Record names below use example.com and the us-east-1 region; copy the real values from the SES console.
Verify the sending identity
Verify the domain in the same SES region used by the application. Identities are regional, so a domain verified in eu-west-1 cannot send through us-east-1.
With Easy DKIM, SES gives you three CNAME records. Publish all Easy DKIM CNAME records exactly as supplied; each points a token selector under _domainkey to a key that AWS hosts and rotates. The identity shows as verified once SES finds all three.
Type Name Value
CNAME token1._domainkey.example.com token1.dkim.amazonses.com
CNAME token2._domainkey.example.com token2.dkim.amazonses.com
CNAME token3._domainkey.example.com token3.dkim.amazonses.comSet up a custom MAIL FROM domain
By default SES uses an amazonses.com address as the envelope sender, so SPF passes for amazonses.com, not for your domain, and does not align for DMARC. Use a custom MAIL FROM domain when aligned SPF is required, and keep its MX and SPF records separate from the root receiving MX.
Choose a subdomain that you do not use for anything else, such as bounce.example.com. SES asks for one MX record and one SPF TXT record on that subdomain. Your root MX records, which decide where your own inbound mail goes, stay unchanged.
Type Name Value Priority
MX bounce.example.com feedback-smtp.us-east-1.amazonses.com 10
TXT bounce.example.com v=spf1 include:amazonses.com ~all —Add DMARC after SPF and DKIM
Publish DMARC at _dmarc with p=none first and collect aggregate reports. Because SES signs with your domain through Easy DKIM, SES mail usually passes DMARC through DKIM even before the custom MAIL FROM domain exists.
Move toward quarantine or reject only after every legitimate sender passes aligned SPF or DKIM. The DMARC examples show each stage.
_dmarc.example.com TXT v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comRoot SPF only when the root sends
If other services, such as Google Workspace, send from example.com, keep a single root SPF record for them. You do not need include:amazonses.com at the root when SES uses a custom MAIL FROM subdomain; the subdomain has its own record. Use the SPF Checker to confirm there is only one v=spf1 record per name.
Test with a real message
Send a message through SES to a Gmail or Outlook account and open the original headers. Look for dkim=pass with header.d=example.com, spf=pass with smtp.mailfrom=bounce.example.com and dmarc=pass. Then run the DKIM Checker with one of the token selectors and the Email Health Check for the full picture.
Common mistakes to avoid
- Verifying the domain in a different region from the one the application sends through.
- Publishing only one or two of the three Easy DKIM CNAME records.
- Pointing the root MX at feedback-smtp instead of using a MAIL FROM subdomain.
- Adding a second root SPF record just for SES.
- Moving DMARC to p=reject before checking reports for other senders.
Frequently asked questions
Does SES require an SPF record at the root?
Not always. SES can pass DMARC through aligned DKIM; custom MAIL FROM uses its own SPF record.
Why are there three DKIM records?
Easy DKIM publishes multiple selectors so AWS can rotate signing keys safely.
Can I add the CNAMEs at Cloudflare with the proxy on?
DKIM CNAMEs must be DNS-only. A proxied record does not return the CNAME target that SES checks.
What happens if the MAIL FROM MX record is missing?
SES can fall back to its default amazonses.com MAIL FROM or reject sending, depending on the behaviour you chose for an MX failure.
Does this setup receive mail?
No. These records authenticate sending. Receiving mail at the domain is controlled by its root MX records; see the SES receiving guide.