Email authentication
Amazon SES: SPF, DKIM and DMARC
The records Amazon SES documents for sending as your own domain. Each line links to Amazon SES's documentation; checked on 2026-10-19.
| DKIM (Easy DKIM) | Three CNAME records of the form <token>._domainkey.<domain> pointing to <token>.dkim.amazonses.com docs.aws.amazon.com/ses/latest/dg/send-email-authentication-dkim-easy.html |
|---|---|
| Easy DKIM key length | RSA 2048-bit by default; 1024-bit can be chosen docs.aws.amazon.com/ses/latest/dg/send-email-authentication-dkim-easy.html |
| Custom MAIL FROM | A subdomain with an MX record to feedback-smtp.<region>.amazonses.com docs.aws.amazon.com/ses/latest/dg/mail-from.html |
| SPF include | include:amazonses.com in a TXT record on the custom MAIL FROM subdomain docs.aws.amazon.com/ses/latest/dg/mail-from.html |
| DMARC alignment | DKIM alignment comes from Easy DKIM on your domain; SPF aligns only with a custom MAIL FROM domain docs.aws.amazon.com/ses/latest/dg/mail-from.html |
Checked against Amazon SES's documentation on 2026-10-19. Providers change their instructions; the linked page is the authority.
DMARC, whichever provider you use
- Publish one TXT record at
_dmarc.yourdomain.com, starting withv=DMARC1; p=none; rua=mailto:…to collect reports. - When reports show only your own senders, move to
p=quarantine, thenp=reject. - DMARC passes when SPF or DKIM passes and aligns with the From domain, so sign with your own domain.
Check your domain in a few seconds
SPF, DKIM, DMARC and MX, with what to fix. Free, nothing stored.