Amazon SES: SPF, DKIM and DMARC setup

This guide shows the DNS records Amazon SES needs so your email is authenticated: SPF, DKIM and DMARC. Use the exact values from your Amazon SES account where they differ — providers update them from time to time.

1. SPF record for Amazon SES

include:amazonses.com

By default SES sends with an amazonses.com envelope sender, so SPF does not align with your domain. Configure a custom MAIL FROM domain (e.g. bounce.yourdomain.com) with the MX record SES shows and a TXT record v=spf1 include:amazonses.com ~all on that subdomain.

Use the SPF Generator to combine several services and the SPF Checker to confirm you stay under 10 DNS lookups.

2. DKIM for Amazon SES

In Amazon SES, follow this path and publish the record it shows:

1. Amazon SES console → Configuration → Identities → your domain → Authentication → Easy DKIM (RSA 2048)
2. Publish the three CNAME records shown.
3. Give DNS a few minutes, then confirm the record with the DKIM Checker.

Once published, verify it with the DKIM Checker (it can also discover common selectors).

3. DMARC

After SPF and DKIM pass, add a DMARC record so receivers know your policy and send you reports. Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Then follow the step-by-step DMARC rollout to reach quarantine and reject safely.

Where to add the records

• Cloudflare — Cloudflare dashboard → select your domain → DNS → Records → Add record. For mail records keep the proxy (orange cloud) OFF.
• GoDaddy — GoDaddy → My Products → your domain → DNS → Manage DNS → Add New Record.
• Namecheap — Namecheap → Domain List → Manage → Advanced DNS → Add New Record. Use "@" for the root domain.
• Hostinger — Hostinger hPanel → Domains → your domain → DNS / Nameservers → Manage DNS records.
• Amazon Route 53 — AWS console → Route 53 → Hosted zones → your domain → Create record. Wrap TXT values in quotes.

Frequently asked questions