Amazon SES: DKIM and SPF setup

Before you start

You need access to the Amazon SES console and to the DNS settings of example.com. The SES pages this guide is written from do not name the IAM permissions the console steps need.

SES works per AWS Region. Amazon says the verification records are different in each Region. If you send from example.com in more than one Region, create and verify a domain identity in each of them.

Turn on DKIM

Amazon calls this Easy DKIM. SES creates the key and asks for three CNAME records.

If example.com is not yet an identity in SES:

1. Open the SES console at https://console.aws.amazon.com/ses/.
2. In the navigation pane, under Configuration, choose Identities, then Create identity.
3. Under Identity details, select Domain and enter example.com. Do not include www., or verification fails.
4. Under Verifying your domain, SES uses Easy DKIM with a 2048-bit key by default. To change it, expand Advanced DKIM settings.
5. Choose Create identity.

If example.com is already an identity, open it from Identities. On the Authentication tab, in the DomainKeys Identified Mail (DKIM) container, choose Edit. Under Advanced DKIM settings, choose Easy DKIM, check Enabled under DKIM signatures, and choose Save changes.

Then publish the records:

1. On the identity's Authentication tab, expand Publish DNS records.
2. Copy the three CNAME records, or choose Download .csv record set.
3. Add them at your DNS host. Each name has the form token._domainkey.example.com, and each value is the token followed by an SES domain such as token.dkim.us-west-2.amazonses.com. Use the exact names SES shows. Do not add an underscore before the token.

If Route 53 hosts example.com in the same AWS account, SES can publish the records for you.

Sign with your own domain

Amazon says SES adds its own DKIM signature with d=amazonses.com to your mail. SES keeps it because it needs it for complaint feedback loops. That signature does not align with example.com. Set up Easy DKIM as in Turn on DKIM, and SES also signs with example.com. DKIM then aligns.

Amazon notes that an email address you verified on its own inside example.com uses its own settings. Mail from that address is sent without the domain's DKIM. Delete that email address identity to use the domain's settings.

Use your own bounce domain

By default SES uses a subdomain of amazonses.com as the MAIL FROM domain, the address bounces go to. SPF passes for that domain but does not align with example.com. Amazon calls your own bounce domain a custom MAIL FROM domain.

Choose a subdomain of example.com, such as bounce.example.com. Amazon says it must not be a subdomain you send mail from or receive mail at.

1. In the SES console, under Configuration, choose Identities and open example.com. Its status must be Verified.
2. In the Custom MAIL FROM domain pane, choose Edit.
3. Select Use a custom MAIL FROM domain and enter the subdomain in MAIL FROM domain.
4. For Behavior on MX failure, choose Use default MAIL FROM domain to fall back to amazonses.com, or Reject message to stop sending while the record is missing.
5. Choose Save changes.
6. Publish the two records shown under Publish DNS records at your DNS host:

region is the AWS Region, such as eu-west-1. Publish exactly one MX record on the subdomain. With more than one, the setup fails.

Amazon adds that SPF alignment through SES needs relaxed SPF alignment in your DMARC record. That is the default when your record has no aspf=s.

SPF

Amazon says SPF is set up for you on the default MAIL FROM domain, and passes there. An include:amazonses.com in the SPF record of example.com itself does not make SES mail align, because SPF is checked against the MAIL FROM domain. For aligned SPF, use a custom MAIL FROM domain as in Use your own bounce domain. Its SPF record goes on that subdomain.

Check the DKIM key

Amazon's DKIM troubleshooting page lists these causes:

1. DKIM verification stays pending. Wait up to 72 hours. Then check the CNAME names. Some DNS hosts add example.com to every name, which turns token._domainkey.example.com into token._domainkey.example.com.example.com.
2. Mail is not signed with example.com. Check that DKIM is enabled on the identity, and that you are not sending from an email address you verified separately.
3. SES says your DKIM setup has been or will be revoked. SES can no longer find the CNAME records. Publish them again within the time the email gives, or SES turns off DKIM signing and you have to set up DKIM from the beginning.
4. Two DKIM signatures. The extra one with d=amazonses.com comes from SES. Amazon says you can ignore it.

Check it worked

1. On the identity's Authentication tab, the DKIM configuration shows Successful and the identity status shows Verified. Amazon says DNS changes can take up to 72 hours.
2. For a custom MAIL FROM domain, SES emails you when it finds the MX record. The state is Pending until then, and Success once found. After 72 hours without the record, it becomes Failed and you have to start its setup again.
3. Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM and SPF align for Amazon SES.

Amazon's pages: Creating and verifying identities, Easy DKIM, Using a custom MAIL FROM domain and DKIM problems.