Guide
How to set up DMARC for Amazon SES
SES is a relay, so alignment is everything. Here's how to get DKIM and SPF aligned to your domain and enforce DMARC.
Check your DMARC record →What it is
Amazon SES sends on your behalf, but by default its envelope (return-path) uses amazonses.com — which doesn't align with your domain, so DMARC can fail unless you set alignment up deliberately.
The clean fix is Easy DKIM (which signs with your domain and gives DKIM alignment) plus, optionally, a custom MAIL FROM domain (which gives SPF alignment). DKIM alignment alone is usually enough to pass DMARC.
Why it matters
SES is used for high-volume transactional and marketing mail, so a misaligned setup means a lot of legitimate mail silently failing DMARC. Getting alignment right is what lets you move SES traffic to p=reject without breakage.
Because SES is a shared platform, DMARC also protects you from other SES customers or spoofers being confused with your domain.
How to set it up
- 1DKIM: in the SES console open Verified identities → your domain → and enable Easy DKIM. SES generates three CNAME records (<token>._domainkey.yourdomain.com → ...dkim.amazonses.com). Publish all three; SES then signs your mail aligned to your domain.
- 2SPF alignment (optional but recommended): configure a Custom MAIL FROM domain (e.g. mail.yourdomain.com) in SES, then publish the MX and SPF TXT record SES shows — typically v=spf1 include:amazonses.com ~all on that subdomain.
- 3DMARC: publish a TXT record at _dmarc.yourdomain.com: v=DMARC1; p=none; rua=mailto:you@yourdomain.com.
- 4Send a test, confirm DKIM (and SPF, if configured) pass and align, then raise DMARC to p=quarantine and p=reject once reports are clean.
Common problems
- Do I need both DKIM and a custom MAIL FROM?
- Not strictly. Easy DKIM alone signs with your domain and gives DKIM alignment, which passes DMARC. A custom MAIL FROM adds SPF alignment for extra resilience — worth it for high volume, optional otherwise.
- My SES mail passes SPF but fails DMARC.
- That's the classic SES trap: SPF passes for amazonses.com (the envelope domain) but doesn't align with your From domain, so DMARC fails. Enable Easy DKIM (or a custom MAIL FROM) so authentication aligns with your domain.
- How do I confirm SES is aligned?
- Check a DMARC aggregate report — SES traffic should show DKIM (and/or SPF) as aligned. Paste one into our free report analyzer to see it broken down by sending source.
Check it — then keep it healthy
Run a free scan now, or let DomainHealthPro monitor it continuously and alert you the moment it breaks.