In Amazon Route 53, add email records in Hosted zones, your zone, then Create record. For the root SPF record leave Record name empty, since AWS says not to type @. Type _dmarc for DMARC and <selector>._domainkey for DKIM. Route 53 does not split long TXT values for you: break a 2048-bit DKIM key into quoted strings of 255 characters or fewer.
Records to add in Route 53
| Purpose | Record type | Record name | Value |
|---|---|---|---|
| SPF | TXT | (empty) | "v=spf1 include:_spf.google.com ~all" |
| DKIM key | TXT | google._domainkey |
"v=DKIM1; k=rsa; p=..." "...rest" |
| DKIM delegated | CNAME | abc123._domainkey |
provider host name |
| DMARC | TXT | _dmarc |
"v=DMARC1; p=none; rua=mailto:..." |
The values come from your mail provider. The integration pages list them per service.
How to add a record
From AWS's console guide:
- Open the Route 53 console at console.aws.amazon.com/route53.
- Choose Hosted zones and click your domain's zone.
- Choose Create record.
- Keep Simple routing.
- Enter Record name, pick Record type (TXT or CNAME), and enter the Value.
- Set TTL (seconds). Microsoft suggests at least 3600 for SPF records to avoid lookup timeouts.
- Choose Create records.
AWS says changes generally reach all Route 53 name servers within 60 seconds. Resolvers that cached the old answer keep it until the TTL expires, and providers run their own checks after that.
Record name conventions
The console shows your zone name next to the Record name box, so you type only the part in front of it.
- Root domain: leave it empty. AWS's record values page says that for a record with the same name as the hosted zone, you should not enter a value "(for example, an @ symbol)". Typing
@is a habit from other DNS hosts. - DMARC:
_dmarc, which publishes as_dmarc.example.com. - DKIM:
google._domainkey,s1._domainkeyand so on. - CNAME at the root: not allowed. AWS says a CNAME cannot have the same name as the hosted zone. Email CNAMEs never sit at the root, so this rarely matters here.
SendGrid's guide lists Route 53 among hosts that append the domain to what you type. If you paste em1234.example.com into Record name, you get em1234.example.com.example.com. Type the prefix only.
TXT values: quotes, one record, 255 characters
Route 53 is stricter about TXT records than most hosts. Three rules from the record types reference matter for email.
Strings over 255 characters must be split by you
AWS: "If you need to enter a value longer than 255 characters, break the value into strings of 255 characters or fewer, and enclose each string in double quotation marks." All the strings go on the same line, separated by spaces:
"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAraC3pqvqTkAfXhUn7Kn3JUNMwDkZ65ftwXH58anno/bElnTDAd/idk8kWpslrQIMsvVKAe+mvmBEnpXzJL+0LgTNVTQctUujyilWvcONRd/z37I34y6WUIbFn4ytkzkdoVmeTt32f5Lx" "egfYP4P/w7QGN1mOcnE2Qd5SKIZv3Ia1p9d6uCaVGI8brE/7zM5c/zMthVPE2WZKA28+QomQDH7ludLGhXGxpc7kZZCoB5lQiP0o07Ful33fcED73BS9Bt1SNhnrs5v7oq1pIab0LEtHsFHAZmGJDjybPA7OWWaV3L814r/JfU2NK1eNu9xYJwA8YW7WosL45CSkyp4QeQIDAQAB"
That key is the sample from Google's DKIM troubleshooting page, split into two strings of 202 and 208 characters. Receivers join the strings without adding a space, so split anywhere you like, as long as no string is longer than 255 characters. The whole value can be up to 4,000 characters.
Pasting a 2048-bit key as one unquoted string is the classic Route 53 DKIM failure.
One TXT record per name, one value per row
AWS asks you to "include all values for a domain (example.com) or subdomain (www.example.com) in the same TXT record". The root of a domain often carries several TXT values: SPF, a Google site verification string, a Microsoft MS= code. In Route 53 they are rows in one record set:
"v=spf1 include:_spf.google.com include:amazonses.com ~all"
"google-site-verification=abc123"
To add SPF to a root that already has a TXT record, edit that record and add a row. Make sure only one row starts with v=spf1.
Quotes and special characters
Wrap each value in double quotes. A literal quote inside a value needs a backslash, \". Characters outside plain ASCII must be written as three-digit octal escapes. SPF, DKIM and DMARC values never need either.
Do not use the SPF record type
Route 53 still offers SPF in the record type list. AWS's own page says it no longer recommends it, quoting RFC 7208 section 14.1: its use "is no longer appropriate for SPF version 1". Publish SPF as TXT. Check the lookup count with the SPF checker once the record is live.
DKIM CNAMEs and Amazon SES
Route 53 has no proxy setting, so CNAMEs for Microsoft 365, SendGrid or Mailgun just need the prefix as Record name and the provider's host name as Value. A trailing dot on the value is optional; AWS says Route 53 treats www.example.com and www.example.com. as identical.
If you send through Amazon SES in the same AWS account, the SES console can create the records for you. AWS's SES identities guide says that when Route 53 hosts the domain, SES can publish the three Easy DKIM CNAMEs automatically, and the custom MAIL FROM setup has a Publish Records Using Route 53 button. See the Amazon SES page for the values.
DMARC record
Create a TXT record with Record name _dmarc:
"v=DMARC1; p=none; rua=mailto:dmarc@example.com"
Only one DMARC record is allowed on the name, so if _dmarc already exists, edit it. The DMARC generator builds a valid value, and the DMARC analyzer reads the reports once they arrive.
Checking the result
Run the SPF checker and the DMARC checker on the root domain. For DKIM, use the DKIM checker with your own domain and selector. If the key comes back short or invalid, look at the TXT value in the console: a missing quote between strings, or a single string over 255 characters, is the usual cause. dig TXT google._domainkey.example.com +short should print two or more quoted strings for a 2048-bit key.