DKIM & SPF Setup for Amazon SES

To set up or edit your SPF record, you will need to add: include:amazonses.com

Edit existing SPF record

1. Log in to your DNS hosting provider
2. Look for a TXT containing v=spf1
3. In your existing SPF record, you will append include:amazonses.com
4. For example, if your existing record looks like v=spf1; mx; ip4:1.2.3.4; you would add the above include as follows v=spf1; mx; ip4:1.2.3.4; include:amazonses.com

Create a new SPF record

1. Follow the instructions from our How to Create a New SPF Record Guide.
2. In the Value field, enter: v=spf1 include:amazonses.com ~all and Save the TXT record.

Records for Subdomains

If you are creating a record for a subdomain, you will want to make sure that you specify the sub part of the domain in the Host/Name/Alias field for most DNS providers.

1. Enter the sub part of the domain, for example if the subdomain is mail.mxtoolbox.com you would want to enter mail into that field.

SPF and DMARC Alignment

By default, Amazon SES will set you up for sending using one of their domains for the return-path address. This domain will NOT pass SPF Alignment. At this time, this provider does NOT provide any mechanism that will allow SPF Alignment to pass. You need to enable DKIM for this provider to ensure your email will pass DMARC Compliance.

How to Set Up/Modify DKIM for Amazon SES

DomainKeys Identified Mail (DKIM) is a protocol that enables a company to take responsibility for sent messages that can be verified by mailbox providers. Basically, DKIM allows the outbound domain to digitally sign email to provide legitimacy for the receiver. Below is a guide on how to use DKIM with Amazon SES (Easy DKIM) to ensure that recipient email systems trust messages sent from your custom domain.

Designed to prevent spoofing attacks, DKIM works in tandem with SPF to attain DMARC compliancy. DKIM lets a company add a digital signature to emails in the message header, which allows recipient systems to use the signature as a validation point to determine if incoming mail is legitimate.

You can use the Amazon SES console to configure Easy DKIM settings and to enable/disable automatic DKIM signing for your email messages. To set up Easy DKIM, you must be able to edit your domain’s DNS records.

To implement Easy DKIM for the Amazon SES platform via a new domain, follow these steps:

• Go to your verified domain list in Amazon SES console

• Click Verify a New Domain

• Enter your domain name, select Generate DKIM Settings, click Verify This Domain

• Complete domain verification by updating your domain’s DNS settings with the TXT record information from the Domain Verification Record in the Verify a New Domain box

• Set up DKIM by updating your domain’s DNS settings with the CNAME record information from box

• Enable DKIM signing for your custom domain in Amazon SES; DKIM Verification Status for that domain will change from “in progress” to “success”

An example of enabling DKIM signing for your custom domain is as follows:

New-DkimSigningConfig -DomainName yourdomain.com -Enabled $true

As a user of this outbound email provider, Amazon SES customers are afforded DKIM signing because it supports this mechanism. By utilizing Amazon’s self-service portal, you can manually set up DKIM at your convenience via CNAME records mentioned above This Amazon SES product provides beneficial components (e.g., DKIM signing, self-service set up with CNAME records) that result in a streamlined process.