Route 53 is AWS’s DNS service, and while it’s aimed at developers, adding these records is mechanical once you know the fields. A DNS record is just a labelled line stating a fact about your domain; for email you add three, all inside one hosted zone.
TXT vs CNAME, and “Record name” vs “Value”
Two record types come up:
- A TXT record holds text. SPF and DMARC are both TXT — the text is the policy. In Route 53, TXT values must be enclosed in double quotes.
- A CNAME record is a pointer that says “for this name, look at that other name instead.” Mail providers usually give DKIM as a CNAME so they can rotate the key transparently.
Route 53 calls the two fields Record name (the host) and Value. The Record name is where the record lives — leave it blank for the root domain (Route 53 shows the zone’s apex when the name is empty), or type a subdomain like _dmarc. The Value is what the record says.
1. Open your hosted zone
Sign in to the AWS Console, open Route 53 → Hosted zones, and click your domain’s zone. You’ll see its records and a Create record button. AWS’s official walkthrough for creating records is here. Use the default “Quick create” view for all three.
2. Add the SPF record (a TXT at the root)
SPF lists the servers allowed to send mail as your domain. Click Create record and set:
- Record name: leave blank (this is the root domain)
- Record type: TXT
- Value:
"v=spf1 include:amazonses.com ~all"— note the surrounding double quotes
Leave TTL at the default and click Create records. Two rules: the value must be quoted in Route 53, and you may have only one SPF record — if a TXT with v=spf1 exists, edit it and merge the new include: in. Build a clean string with the SPF Generator. (Sending through Amazon SES? Pair this with our SES DKIM & DMARC guide.)
3. Add the DKIM record (usually a CNAME)
DKIM lets your provider sign each message. Your provider — or SES “Easy DKIM,” which gives you three CNAMEs — supplies the exact records. For each one, click Create record and set:
- Record name: the selector, e.g.
selector1._domainkey(Route 53 appends your domain, so don’t type the full name) - Record type: CNAME
- Value: the target given, e.g.
selector1-example-com._domainkey.provider.com
Route 53 note: CNAME values are not quoted — quoting is a TXT-only rule. Enter the target hostname plain. If your provider gave DKIM as a TXT record instead, create a TXT with the selector as the Record name and the quoted "v=DKIM1; k=rsa; p=…" as Value. Long DKIM keys sometimes exceed 255 characters; in Route 53 you split them into multiple quoted strings on one line, e.g. "v=DKIM1; k=rsa; p=MIGf…" "…rest". Verify later with the DKIM Checker.
4. Add the DMARC record (a TXT at _dmarc)
DMARC ties SPF and DKIM to the visible From address and tells inboxes what to do on failure. Click Create record and set:
- Record name:
_dmarc - Record type: TXT
- Value:
"v=DMARC1; p=none; rua=mailto:dmarc@example.com"— quoted
Start with p=none to monitor without affecting delivery, and point rua= at a mailbox you check. Generate one with the DMARC Generator and validate it with the DMARC Checker. When ready to enforce, follow moving DMARC to reject safely.
Route 53-specific gotchas
- Quote every TXT value. SPF and DMARC values must be wrapped in
"…". An unquoted TXT is the most common Route 53 mistake. - Blank Record name = root. Leave it empty for the apex domain; don’t type
@(Route 53 doesn’t use that convention). - Split long DKIM keys into multiple quoted strings on the same line — don’t truncate them.
- One SPF record only. Merge, don’t duplicate.
- Editing the right zone. If you have both a public and a private hosted zone for the domain, edit the public one.
Verify propagation
Route 53 propagates fast, but caching elsewhere varies. Confirm the records are visible worldwide with the DNS Propagation Checker, then check each individually with the SPF Checker, DKIM Checker and DMARC Checker. To confirm all three together, run the Email Health Check.
For what each record does and how DMARC alignment decides a pass, read the complete SPF, DKIM & DMARC guide. Using a different registrar? See the equivalents for Cloudflare, GoDaddy, Namecheap, cPanel and Squarespace.