Amazon SES passes DMARC through DKIM: turn on Easy DKIM and publish the three CNAME records SES gives you. SPF is a separate step. SES sends with a MAIL FROM under amazonses.com by default, so SPF passes but does not align. To align SPF, set a custom MAIL FROM subdomain with an MX record and v=spf1 include:amazonses.com ~all.
The records at a glance
| Record | Type | Host | Value |
|---|---|---|---|
| DKIM (x3) | CNAME | <token>._domainkey |
<token>.dkim.<region>.amazonses.com |
| MAIL FROM MX | MX | mail (your subdomain) |
10 feedback-smtp.<region>.amazonses.com |
| MAIL FROM SPF | TXT | mail (your subdomain) |
v=spf1 include:amazonses.com ~all |
| DMARC | TXT | _dmarc |
v=DMARC1; p=none; rua=mailto:dmarc@example.com |
mail is our example name for the MAIL FROM subdomain. Any unused subdomain works. The region in the values is the AWS Region you send from, such as us-east-1 or eu-west-1.
DKIM: Easy DKIM with three CNAMEs
Easy DKIM is the default. AWS signs every message from the identity with a 2048-bit key and publishes the public half on its side. You only point CNAMEs at it.
- Open the SES console at console.aws.amazon.com/ses.
- Under Configuration, choose Identities and open your domain identity (or create one).
- On the Authentication tab, in the DomainKeys Identified Mail (DKIM) box, choose Edit.
- Under Advanced DKIM settings, choose Easy DKIM.
- Set DKIM signing key length to
RSA_2048_BIT(the default) orRSA_1024_BIT. - Tick Enabled under DKIM signatures and choose Save changes.
- Copy the three CNAME records from Publish DNS records, or download them as a .csv file.
Each record looks like this, with a random token in place of abc123:
abc123._domainkey.example.com CNAME abc123.dkim.us-west-2.amazonses.com
The hosted zone part of the value varies by AWS Region and identity, according to the identities guide. Because of that, copy the values from your own console or from the SigningHostedZone field in the API response, never from someone else's example.
AWS warns against one specific typo: an extra underscore at the start. abc123._domainkey.example.com is right. _abc123._domainkey.example.com is wrong.
If your DNS is in Route 53 under the same AWS account, SES can publish the records for you. Anywhere else, you add them by hand. SES says it can take up to 72 hours to detect them. When it does, the DKIM status turns Successful and the identity shows Verified.
Since these are CNAMEs, the 2048-bit key never sits in your zone, and the 255-character TXT limit does not apply. AWS keeps 1024 bits only for DNS providers that cannot handle the longer key. You can change key length at most once in 24 hours.
There is also BYODKIM, where you supply your own key pair and publish a TXT record. AWS warns that if you switch from BYODKIM to Easy DKIM, mail can go out unsigned while the new setup is pending.
SPF: the custom MAIL FROM domain
AWS's SPF page explains that SES uses a subdomain of amazonses.com as the MAIL FROM by default. SPF passes for that domain, but it is not your domain, so it does not align with your From address.
To align SPF, set a custom MAIL FROM. AWS's rules for it: it must be a subdomain of a verified identity's parent domain, and it should not be a subdomain you send from or receive mail on.
- Open the verified domain identity.
- In the Custom MAIL FROM domain pane, choose Edit.
- Tick Use a custom MAIL FROM domain and enter the subdomain, for example
mail.example.com. - Choose Behavior on MX failure. Use default MAIL FROM domain falls back to
amazonses.comif your MX breaks. Reject message refuses to send with aMailFromDomainNotVerifiederror. - Save, then publish the MX and TXT records that appear.
mail.example.com MX 10 feedback-smtp.us-east-1.amazonses.com
mail.example.com TXT "v=spf1 include:amazonses.com ~all"
The MAIL FROM subdomain must have exactly one MX record. A second MX makes the setup fail. AWS says SES may take up to 72 hours to detect the MX.
Where people put include:amazonses.com by mistake
In our scan of the Tranco top 1,000 domains on 19 October 2026, 77 root SPF records contained include:amazonses.com. For SES mail that include does not help, because SES never uses your root domain as the envelope sender. It belongs on the MAIL FROM subdomain. On the root it only spends lookups toward the 10 that SPF allows. Check your count with the SPF checker.
How Amazon SES aligns for DMARC
- DKIM alignment. Easy DKIM signs with
d=set to your verified domain, so DKIM aligns. This is the main path. - SPF alignment. Only with a custom MAIL FROM, and only under relaxed SPF alignment. The DMARC page is explicit that your DMARC policy must not use
aspf=s, becausemail.example.comandexample.comdo not match exactly. Relaxed is the default if you leaveaspfout.
If you set Use default MAIL FROM domain and your MX ever breaks, SES quietly falls back to amazonses.com. SPF alignment disappears and DKIM carries DMARC alone. That is fine as long as DKIM is healthy, and a reason to watch your reports.
DMARC record
Publish one TXT record at _dmarc.example.com:
_dmarc TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
Leave aspf out or set aspf=r. The DMARC generator builds the record, and the DMARC analyzer shows SES traffic by source IP once reports arrive.
Checking the result
Send a test through SES to a Gmail account and choose Show original. You want DKIM: PASS with your domain, SPF: PASS with your MAIL FROM subdomain if you set one, and DMARC: PASS. The s= value in the DKIM-Signature header is one of your three tokens.
Run the DKIM checker with your domain and one token as the selector, the SPF checker on mail.example.com, and the DMARC checker on the root domain.