DMARC for email delivery services
How do I set up DMARC for Amazon SES?
Amazon SES signs with Easy DKIM through three CNAME records. By default its MAIL FROM is on amazonses.com, so SPF cannot align until you set up a custom MAIL FROM domain.
The DNS records for Amazon SES
SPF: TXT on your custom MAIL FROM subdomain, not your root
v=spf1 include:amazonses.com ~allNeeded only for a custom MAIL FROM. That subdomain should not be used for sending or receiving other mail.
DKIM selector: Three tokens generated per identity
<token>._domainkey.example.com CNAME <token>.dkim.<region>.amazonses.com (three of these)The hosted zone in the target varies by AWS Region and identity. Copy all three from the identity's Publish DNS records table. SES defaults to a 2048-bit key.
Custom MAIL FROM MX
<subdomain>.example.com MX 10 feedback-smtp.<region>.amazonses.comValues in angle brackets are specific to your account. Copy the real ones from Amazon SES rather than from this page.
Alignment caveats
- ✓Default MAIL FROM is a subdomain of amazonses.com. SPF passes there, but for that domain rather than yours, so it does not count for DMARC.
- ✓If the MAIL FROM MX record breaks and behaviour on MX failure is set to use the default, SES falls back to amazonses.com and SPF alignment is lost.
- ✓Identities are per Region, and their DNS records differ, so verify each Region you send from.
- ✓The custom MAIL FROM domain must have exactly one MX record, or AWS setup fails.
From p=none to p=reject with Amazon SES
- Publish
v=DMARC1; p=none; rua=mailto:<your-business-id>@mail.yourdmarc.online, or build it with the DMARC generator. Delivery does not change at this stage. - Add the records above, then verify them with the SPF checker and the DKIM checker, entering your selector.
- Rely on Easy DKIM as your aligned pass and add a custom MAIL FROM so SPF aligns as well. That way one failure does not fail DMARC.
- Move to
p=quarantinewhen your legitimate mail passes, and watch the reports for anything you missed. - Move to
p=rejectwithsp=reject. Read the enforcement guide for what tends to break, and keep monitoring afterwards.
Sources
Taken from Amazon SES's own documentation, checked on 1 November 2026. Providers change these, so their setup screen wins over this page.
See how Amazon SES really does on your domain
Check a real message against the Gmail, Yahoo and Outlook.com sender rules, or test whether a stranger can send mail as your domain. Both are free.
Frequently asked questions
What SPF record does Amazon SES need?
v=spf1 include:amazonses.com ~all, published as: TXT on your custom MAIL FROM subdomain, not your root. Needed only for a custom MAIL FROM. That subdomain should not be used for sending or receiving other mail.
What DKIM selector does Amazon SES use?
Three tokens generated per identity. The hosted zone in the target varies by AWS Region and identity. Copy all three from the identity's Publish DNS records table. SES defaults to a 2048-bit key.
Will Amazon SES mail pass DMARC alignment?
Only once a passing SPF or DKIM result is on your From domain or its organizational domain. Default MAIL FROM is a subdomain of amazonses.com. SPF passes there, but for that domain rather than yours, so it does not count for DMARC.
How do I reach p=reject with Amazon SES?
Start at p=none with a rua address, finish the Amazon SES setup, then read your reports. Rely on Easy DKIM as your aligned pass and add a custom MAIL FROM so SPF aligns as well. That way one failure does not fail DMARC. Move to p=quarantine, then p=reject, once your legitimate mail passes.
As a global team, we’re always available. Let’s talk!
© 2026 yourDMARC
Download to read the eBook
