Guides · Updated 2026-10-11

Amazon SES: DKIM, custom MAIL FROM and DMARC

DKIM (Easy DKIM)

When you verify a domain identity in SES with Easy DKIM, SES gives you three CNAME records of the form token._domainkey.yourdomain.com pointing to token.dkim.amazonses.com. Publish all three. SES then signs with your domain, which aligns for DMARC.

SPF via custom MAIL FROM (optional)

By default SES uses an amazonses.com Return-Path, so SPF won't align. To align SPF too, set a custom MAIL FROM subdomain such as mail.yourdomain.com and publish:

• An MX record pointing to feedback-smtp.<region>.amazonses.com.
• A TXT record: v=spf1 include:amazonses.com ~all.

DKIM alone is enough to pass DMARC, but having both makes you more resilient.

Sources

• AWS: Easy DKIM in Amazon SES
• AWS: Using a custom MAIL FROM domain

This guide is general information, not legal or professional advice. Provider screens change; always confirm the exact values shown in your own account.