Amazon SES SPF and DKIM setup, explained

Amazon SES has a default behaviour that trips people up: out of the box, the envelope sender (MAIL FROM) it uses is a subdomain of amazonses.com, not your domain. SPF can pass against that, but it won't align with your visible From: domain for DMARC purposes unless you fix it.

The default MAIL FROM domain problem

Without configuration, SES sends using something like bounce.us-east-1.amazonses.com as the envelope sender. SPF checks that domain, and it passes - but DMARC alignment checks whether that domain matches (or is a subdomain of) your visible From: header domain. amazonses.com doesn't match yourdomain.com, so SPF alignment fails for DMARC even though SPF itself "passed."

Setting a custom MAIL FROM domain

In the SES console, under your verified identity's settings, set a custom MAIL FROM domain - typically a subdomain like mail.yourdomain.com.

SES then requires two DNS records for that subdomain:

mail.yourdomain.com.    MX    10 feedback-smtp.us-east-1.amazonses.com.
mail.yourdomain.com.    TXT   "v=spf1 include:amazonses.com ~all"

(Replace the region in the MX target with whatever AWS region your SES identity is in - check the exact value SES's console shows you, since it is region-specific.)

This makes mail.yourdomain.com the envelope sender, which is a subdomain of yourdomain.com - and that now aligns for DMARC's SPF check.

Setting up DKIM (Easy DKIM)

In the same identity settings, enable Easy DKIM. SES generates three CNAME records specific to your account and identity:

<token1>._domainkey.yourdomain.com.    CNAME    <token1>.dkim.amazonses.com.
<token2>._domainkey.yourdomain.com.    CNAME    <token2>.dkim.amazonses.com.
<token3>._domainkey.yourdomain.com.    CNAME    <token3>.dkim.amazonses.com.

The tokens are generated per identity - copy them exactly from the SES console, don't guess or reuse tokens from another account. SES uses three records so it can rotate keys without requiring new DNS changes later.

Verifying both

$ dig mail.yourdomain.com MX +short
10 feedback-smtp.us-east-1.amazonses.com.

$ dig mail.yourdomain.com TXT +short
"v=spf1 include:amazonses.com ~all"

$ dig <token1>._domainkey.yourdomain.com CNAME +short
<token1>.dkim.amazonses.com.

SES's console also shows a verification status for each - wait for it to flip to "Verified" rather than relying on DNS resolving alone, since SES re-checks on its own schedule.

Confirming alignment in a real message

Send a test email to an address you control and check headers:

Authentication-Results: mx.google.com;
       dkim=pass header.d=yourdomain.com;
       spf=pass smtp.mailfrom=mail.yourdomain.com;
       dmarc=pass header.from=yourdomain.com

smtp.mailfrom=mail.yourdomain.com confirms the custom MAIL FROM domain is active and aligned.

What not to do

• Don't skip the custom MAIL FROM domain step and assume default SES sending is DMARC-aligned - it passes SPF but fails alignment, which is a silent failure mode until you check headers directly.
• Don't publish the Easy DKIM CNAMEs under the wrong subdomain - they must sit exactly at <token>._domainkey.yourdomain.com, not under the MAIL FROM subdomain.
• Don't forget the MX record for the MAIL FROM subdomain - SES needs it to receive bounce and complaint notifications at that address; without it, bounce handling breaks even though sending still works.

Amazon SES authentication quick reference

FAQ

Do I need a custom MAIL FROM domain if I only care about SPF passing, not DMARC? If DMARC alignment doesn't matter to you, the default amazonses.com MAIL FROM domain will pass SPF on its own. But since Gmail and Yahoo's bulk-sender rules effectively require DMARC alignment at scale, treat the custom MAIL FROM domain as standard practice rather than optional.

What happens if the MX record on my MAIL FROM subdomain is missing? Sending still works, but SES can't deliver bounce and complaint notifications back to that subdomain, which degrades your visibility into delivery problems and can affect how SES itself tracks your sending reputation internally.

Can I reuse the same MAIL FROM subdomain across multiple SES identities? Each verified identity in SES configures its own MAIL FROM domain setting; reusing the same subdomain across identities is possible but complicates bounce routing - a dedicated subdomain per identity, or per logical sending use case, is simpler to reason about.

MailPilot warms mailboxes sending through SES-backed infrastructure and checks SPF, DKIM, and DMARC status per domain

Does enabling Easy DKIM change anything about how SES counts sending quota or reputation metrics? No - Easy DKIM only affects message signing and authentication outcomes. SES's sending quota, bounce rate, and complaint rate tracking are calculated independently of whether DKIM is enabled., which is exactly where a MAIL FROM alignment gap like this one surfaces as a failing check instead of a quiet reputation problem.