How to set up DKIM & DMARC for Amazon SES

The short version: verify your domain in SES with Easy DKIM, which publishes three CNAME records; add a custom MAIL FROM subdomain so SPF aligns to your domain; then publish a starter DMARC record. Together these prove to Gmail, Yahoo and Outlook that mail sent through SES is genuinely yours, and DMARC tells inboxes what to do on failure while reporting back to you. Everything here is free apart from your normal SES sending costs, and it’s verifiable in a minute once DNS propagates.

What each piece does here (the non-technical version)

SES is a shared sending platform, so the job is to make its mail look unambiguously like your domain rather than Amazon’s. Easy DKIM is a cryptographic seal SES applies to every message, signed as your domain — Amazon holds the private keys and rotates them, and you just publish three CNAMEs that point at Amazon so verification always resolves. The custom MAIL FROM subdomain fixes SPF: by default SES uses its own bounce domain, which passes SPF but doesn’t align with your From, so you point a subdomain like mail.yourdomain.com at SES to make SPF align too. DMARC is the policy that requires at least one aligned pass and says what to do otherwise. For the mechanics, see the complete SPF, DKIM & DMARC guide.

Step 1 — Verify your domain with Easy DKIM (three CNAMEs)

In the SES console this is the first and most important step:

1. Open the Amazon SES console and go to Configuration → Identities → Create identity.
2. Choose Domain, enter your domain, and under Advanced DKIM settings select Easy DKIM with a 2048-bit key.
3. SES generates three CNAME records. Publish all three at your DNS host exactly as shown.

The three records follow this pattern — the token strings are unique to your identity, so copy them from the console:

Host/Name:  xxxxxxxxxxxx._domainkey Type:       CNAME Value:      xxxxxxxxxxxx.dkim.amazonses.com Host/Name:  yyyyyyyyyyyy._domainkey Type:       CNAME Value:      yyyyyyyyyyyy.dkim.amazonses.com Host/Name:  zzzzzzzzzzzz._domainkey Type:       CNAME Value:      zzzzzzzzzzzz.dkim.amazonses.com  (all three from your SES console)

Once all three resolve, SES flips the identity’s DKIM status to Verified and starts signing. Because the CNAMEs point at Amazon, SES can rotate the underlying keys without you editing DNS again. Amazon’s reference: Easy DKIM in Amazon SES. Verify with the DKIM Checker once it’s live.

Step 2 — Add a custom MAIL FROM domain for SPF alignment

This is the step people skip, and it’s why their SPF passes but DMARC still fails. In the identity you just created, open MAIL FROM domain and set a subdomain such as mail.yourdomain.com. SES then asks you to publish two records at that subdomain: an MX record so SES can receive bounces, and a TXT SPF record authorising SES. The region-specific hostnames come from the console; the pattern is:

Host/Name:  mail   (i.e. mail.yourdomain.com) Type:       MX Value:      10 feedback-smtp.us-east-1.amazonses.com   (your region, from the console) Host/Name:  mail Type:       TXT Value:      v=spf1 include:amazonses.com ~all

With the MAIL FROM subdomain in place, SES uses mail.yourdomain.com as the envelope sender, which is a subdomain of your From domain — so SPF now aligns under relaxed mode and can satisfy DMARC on its own. Amazon’s reference: Using a custom MAIL FROM domain. Confirm the SPF resolves with the SPF Checker. (Note: aligned DKIM from Step 1 already satisfies DMARC by itself; this step adds a second, independent aligned mechanism, which is the robust setup.)

Step 3 — Publish a starter DMARC record

Add DMARC at your root domain in monitor-only mode:

Host/Name:  _dmarc Type:       TXT Value:      v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r

The p=none policy affects no delivery — it just turns on the daily aggregate reports to the rua mailbox, which reveal every service sending as your domain and whether each passes. Build it with the DMARC Generator, validate with the DMARC Checker, and route rua to a parser through DMARC monitoring.

Step 4 — Verify everything passes

After DNS propagates, confirm all three at once with the Email Health Check, or individually with the SPF Checker, DKIM Checker and DMARC Checker. The best real test is SES’s own Send test email feature (or a live send) to a personal Gmail account: open Show original and confirm SPF, DKIM and DMARC all read PASS with your domain in the DKIM d= field.

Step 5 — Move DMARC toward enforcement

After two to four weeks of clean reports, ramp the policy: p=none → p=quarantine (optionally pct=25 first) → p=reject, watching reports at each step. The staged rollout is in the complete guide. If you send both transactional and marketing mail through SES, consider splitting them onto separate subdomains so one stream’s reputation can’t drag the other down.

Common mistakes

• Skipping the custom MAIL FROM domain. Without it, SES’s default bounce domain passes SPF but doesn’t align, so DMARC leans entirely on DKIM. Add MAIL FROM for a robust, two-mechanism setup. See why SPF passes but DMARC fails.
• Publishing only some of the three DKIM CNAMEs. All three must resolve or the identity never reaches Verified and SES won’t sign.
• Using the wrong region hostname. The MAIL FROM MX target is region-specific (for example feedback-smtp.us-east-1.amazonses.com). Copy it from the console for your actual region.
• Proxying the CNAMEs. On Cloudflare these must be DNS-only (grey cloud) or DKIM verification breaks.
• A second SPF record on the root. The SES SPF belongs on the MAIL FROM subdomain, not stacked as a second v=spf1 on your root — two root SPF records is a permerror.

Where the records go

Every record here lives at your domain’s DNS host, not in AWS. On Cloudflare, follow how to add DNS records in Cloudflare. The always-current exact tokens and region hostnames are the ones SES shows in the console when you create the identity and set the MAIL FROM domain — treat those as the source of truth.