Guides › Providers
SPF, DKIM and DMARC for Amazon SES
SPF
By default, SES sends with a MAIL FROM domain under amazonses.com, so SPF passes but doesn't align with your domain. For aligned SPF, set a custom MAIL FROM domain (such as mail.yourdomain.com) and publish:
mail.yourdomain.com MX 10 feedback-smtp.<region>.amazonses.com mail.yourdomain.com TXT v=spf1 include:amazonses.com ~all
DKIM
Easy DKIM gives you three CNAMEs: <token>._domainkey.yourdomain.com → <token>.dkim.amazonses.com. The tokens are random, so our checker can't guess them. Look up one of the selectors in the SES console and paste it into the selector field.
DMARC
DMARC is set once per domain, not per provider. If you don't have one, start in monitoring mode:
Host: _dmarc Type: TXT Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
Once the reports show all your legitimate mail passing, move to p=quarantine and then p=reject. See the rollout guide.
Notes
DKIM alone (aligned) is enough to pass DMARC, but setting up both is more robust.
Use the checker to confirm all three records. It detects Amazon SES's DKIM selector automatically if it's a standard one.