SPF, DKIM and DMARC · Checked 8 November 2026

Amazon SES SPF, DKIM and DMARC records

The records that let mail sent through Amazon SES pass email authentication, and how to confirm they are published correctly.

Check your domain

Enter your domain, then pick the record to check:

SPF

mail.example.com.  IN  TXT  "v=spf1 include:amazonses.com ~all"
  • By default SES uses a subdomain of amazonses.com as the MAIL FROM domain, so SPF passes without any record from you. That pass is for Amazon's domain, not yours.
  • To have SPF align with your own From address, set up a custom MAIL FROM domain: a subdomain of a domain you own, used for nothing else. The record above goes on that subdomain (shown here as mail.example.com), not on your main domain.
  • SES also needs one MX record on that subdomain: 10 feedback-smtp.<region>.amazonses.com, with the region where you verified the domain. Exactly one MX record may exist there, or setup fails.
  • SES copies the exact records into the console under Publish DNS records. The TXT value usually needs its quotation marks.
  • The MX record can take up to 72 hours to be detected. You choose whether SES falls back to its default MAIL FROM domain or rejects mail while it is missing.

Syntax and the 10-lookup limit are covered in SPF record syntax.

DKIM

  • Easy DKIM is the simple route: SES adds a 2048-bit DKIM key to every message from the verified domain. You may choose 1024 bits instead if your DNS provider cannot handle the longer key.
  • You publish the records that the SES console shows for the domain identity. They are generated for you, so copy them from the console. If your DNS is in Route 53, SES can create them for you.
  • You cannot switch key length more than once in 24 hours, or to the length already set.
  • Alternatively you can bring your own key (BYODKIM). Do not switch between the two methods on a live domain without a plan: while Easy DKIM is pending, mail can leave without a signature.

Not sure which selector a message was signed with? See what is a DKIM selector.

DMARC

DMARC is a separate record that you publish yourself, at _dmarc under your domain. Start by only collecting reports, then tighten the policy once the reports show all your senders passing:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Replace the address with a mailbox you control. What is DMARC explains the policies, and how to read a DMARC report shows what to do with the reports.

Common problems

  • More than one MX record on the custom MAIL FROM subdomain, which makes setup fail.
  • Using the MAIL FROM subdomain for anything else, such as receiving or sending mail.
  • The MX record not detected yet. The state stays Pending for up to 72 hours, and mail uses the fallback behaviour you chose.
  • DKIM records published at the wrong host because the DNS provider appended the domain a second time.

Failing messages are diagnosed in why DKIM or DMARC fails.

Sources

Values on this page come from the provider's own documentation, last checked on 8 November 2026. Providers change these settings, so confirm against the current page before you edit DNS:

Frequently asked questions

Does Amazon SES need an SPF record?

Not by default. SES uses its own MAIL FROM domain, which passes SPF for Amazon's domain. To make SPF align with your domain, set up a custom MAIL FROM domain with its own MX and SPF TXT records.

What is the SPF record for Amazon SES?

v=spf1 include:amazonses.com ~all, published on your custom MAIL FROM subdomain together with a single MX record that SES specifies.

What key length does Amazon SES DKIM use?

Easy DKIM uses 2048 bits by default and lets you choose 1024. You can change it at most once in 24 hours.

Why is my custom MAIL FROM domain stuck on Pending?

SES has not found the MX record yet. It keeps checking for up to 72 hours. Confirm that exactly one MX record exists on that subdomain, with the right region in its value.