Your domain is where brand trust begins. Start domain scan
Free trialSchedule a demo

How to set up SPF and DKIM for Amazon SES

Short answer

For Amazon SES, enable Easy DKIM (publish the three CNAME records SES generates) and set a custom MAIL FROM domain so SPF aligns to your domain. Easy DKIM alone already gives DMARC-aligned authentication; the custom MAIL FROM adds aligned SPF.

Easy DKIM

In the SES console, verify your domain and enable Easy DKIM. SES gives you three CNAME records (…_domainkey → dkim.amazonses.com). Publish them; SES rotates the keys for you.

Custom MAIL FROM for SPF alignment

Set a custom MAIL FROM subdomain (e.g. mail.yourdomain.com) and publish the MX + SPF (v=spf1 include:amazonses.com ~all) records SES provides. This aligns SPF to your domain for DMARC.

  1. 1

    Verify an SES DKIM CNAME

    Check one of the three selectors:

    $ dig CNAME <token>._domainkey.yourdomain.com +short

Check your SPF record now

Open the free SPF checker →

Frequently asked questions

Is Easy DKIM enough for DMARC?

Yes — Easy DKIM signs with your domain, so DMARC passes on DKIM alignment even without the custom MAIL FROM. The MAIL FROM just adds aligned SPF as a second path.

Related guides

How to set up SPF and DKIM for SendGrid → Setup guides Why DKIM fails and how to fix it → Fixes Why does my mail fail DMARC (and how to fix it) → Fixes

Aligns with the Google/Yahoo 2024 sender requirements.

Reviewed by the Skysnag Security Team. Last updated .