AWS SES needs three things in your DNS: 3 DKIM CNAME records, a DMARC TXT record, and SPF on a custom MAIL FROM subdomain (one MX and one TXT). Gmail and Yahoo expect all three from anyone sending in bulk, and AWS approves production access faster for a domain that has them.
What each one does.
DKIM
Signs every email with a key that belongs to your domain. AWS holds the private key and signs for you; your DNS points to the public key. Easy DKIM in SES uses a 2048-bit key by default.
SPF
Lists the servers allowed to send for a domain. It checks the hidden MAIL FROM (bounce) address, not the From address your reader sees. That is why, for SES, SPF belongs on a subdomain such as mail.example.com.
DMARC
Ties the two to the From address your reader sees, and tells mailbox providers what to do with mail that fails. An email passes DMARC when DKIM or SPF passes and matches your From domain.
The records.
For a domain example.com sending from AWS region us-east-1, the records look like this. The DKIM names and values are unique to your domain: copy them from the SES console, never type them.
Name Type Value
abc123._domainkey.example.com CNAME abc123.dkim.amazonses.com
def456._domainkey.example.com CNAME def456.dkim.amazonses.com
ghi789._domainkey.example.com CNAME ghi789.dkim.amazonses.com
_dmarc.example.com TXT "v=DMARC1;p=none;"
mail.example.com MX 10 feedback-smtp.us-east-1.amazonses.com
mail.example.com TXT "v=spf1 include:amazonses.com ~all"In some newer AWS regions, the DKIM values end in dkim.<region>.amazonses.com instead of dkim.amazonses.com. Another reason to copy, not type.
Step 1. Create the domain in SES and add DKIM.
In the SES console
Go to Identities, choose Create identity, then Domain. Enter your domain. Keep Easy DKIM and RSA_2048_BIT. Choose Create identity.
In your DNS panel
Add the 3 CNAME records SES shows you, exactly as shown.
Wait
SES checks for the records on its own, usually within minutes. It keeps trying for 72 hours. After that SES stops checking, and you start the setup again from the beginning. If the records are not right on day one, fix them before day three.
Step 2. Add DMARC.
Add one TXT record named _dmarc with the value "v=DMARC1;p=none;".
Start with p=none
p=none only watches; nothing is blocked. AWS recommends moving to p=quarantine and then p=reject in steps, once you know every service that sends as your domain passes. Jumping straight to reject can block your own legitimate mail.
One DMARC record only
If _dmarc already has a record, keep it and add nothing. Two DMARC records at the same name make both invalid.
Avoid strict alignment
If your existing record contains aspf=s, SPF cannot align through SES. Remove that tag; relaxed alignment is the default.
Step 3. Add SPF on a custom MAIL FROM subdomain.
By default SES uses its own bounce address under amazonses.com. To make SPF count for your domain, give SES a subdomain of yours.
In the SES console
Open your verified domain under Identities. In Custom MAIL FROM domain, choose Edit, tick Use a custom MAIL FROM domain, and enter mail (giving mail.example.com). For Behavior on MX failure, choose Use default MAIL FROM domain, so your mail keeps going out if the record ever breaks.
In your DNS panel
Add the MX record and the SPF TXT record from the table above, both on mail.example.com. The 10 in the MX value usually goes in its own priority box.
Rules for this subdomain
Use it for nothing else: not as an address you send from, not for receiving mail. It must have exactly one MX record.
The common mistakes.
The domain written twice
Many DNS panels add your domain to the name for you. Typing abc123._domainkey.example.com there creates abc123._domainkey.example.com.example.com. If your panel shows the domain beside the name box, enter only abc123._domainkey.
Cloudflare's orange cloud
On Cloudflare, set the DKIM CNAME records to DNS only (grey cloud). Proxied, they stop pointing at Amazon and DKIM fails.
Adding amazonses.com to your main SPF record
Not needed. SPF checks the bounce address, and with a custom MAIL FROM that is mail.example.com, which has its own SPF record. Your main domain's SPF stays as it is for your own mailbox provider.
Missing quotation marks
Most panels want TXT values inside quotes. Some add them for you. Check the saved record.
How to check.
In the SES console, your domain shows Verified under DKIM, and Successful under Custom MAIL FROM domain. From a terminal:
dig CNAME abc123._domainkey.example.com
dig TXT _dmarc.example.com
dig MX mail.example.com
dig TXT mail.example.comThen send yourself an email at Gmail, open it, choose Show original, and look for PASS beside SPF, DKIM and DMARC.