Mail setup

SPF, DKIM and DMARC with Amazon SES.

The records Amazon SES needs, where to find them, and the failure specific to this provider.

SPF

Add include:amazonses.com to your existing SPF record. Do not create a second record: two SPF records mean neither works, and that is the most common mistake in this whole area.

DKIM

Found in the SES console, under Verified identities, then the domain, then DKIM.

SES uses Easy DKIM by default, publishing three CNAME records that Amazon manages and rotates for you. Take that option rather than the manual key.

Amazon SES publishes keys under a selector Amazon generates per identity, which is what an external check looks for.

DMARC

DMARC is the same regardless of provider, because it is your instruction rather than theirs. Start at v=DMARC1; p=none; rua=mailto:you@yourdomain.com, read the reports, authorise everything legitimate, and only then tighten. The DMARC guide covers the order, and the order is what stops you blocking your own invoices.

Worth knowing with Amazon SES

SES is almost always used for transactional mail rather than mailboxes, and is usually configured by a developer for one feature. It is one of the most common includes left in an SPF record long after the feature moved elsewhere.

Watch the lookup count

Every include costs one of your ten SPF lookups, and so does every include inside it. Adding a third or fourth sender is where domains typically cross the limit, after which the whole record fails silently. See the lookup guide before adding another.

Check yours

Check whether your mail is actually passing.

Plain answers rather than policy strings. Free, no account.

Using a different mail provider?

The records differ per provider, and so do the mistakes.

Mailtrap · Mailchimp and Mandrill · Google Workspace · Salesforce and Marketing Cloud · Microsoft 365 · Mailgun

All 20 in this set