Amazon SES SPF, DKIM, and DMARC setup

Drowning in unreadable DMARC report XML? Paste one into our free reader for a plain-English read. Read your report.

Amazon SES can pass SPF while DMARC fails

That surprises a lot of teams. SES can authenticate the hidden Return-Path with an amazonses.com domain, while your visible From address says example.com. DMARC cares about that match. Fix DKIM first, then add a custom MAIL FROM domain if you want SPF alignment too.

Verify your domain identity in the Amazon SES region you use to send mail.
Enable Easy DKIM on the domain identity. Publish the three CNAME records SES gives you. Keep DKIM signing enabled. Use the 2048-bit key unless your DNS provider cannot handle it.
Create a custom MAIL FROM subdomain, such as bounce.example.com or mail.example.com. Do not use the same host for your website, your normal inbox, or another sender.
Publish the SES MAIL FROM records exactly on that subdomain: exactly one MX record pointing to 10 feedback-smtp.region.amazonses.com, and one TXT record with v=spf1 include:amazonses.com ~all.
Choose the MAIL FROM MX failure setting on purpose. The default fallback can send with an amazonses.com MAIL FROM domain, which loses SPF alignment. Reject message fails fast instead.
Publish DMARC at _dmarc.example.com. Start with p=none and a rua mailbox, then move to p=quarantine or p=reject after reports show every real sender is passing.
Run the domain through the free InboxRadar scorecard after DNS settles. It will show whether SPF, DKIM, DMARC, MX, and common blocklist checks are clean.

SPF: put the record on the right host

For SES, SPF alignment comes from the custom MAIL FROM domain. If you skip custom MAIL FROM, SPF may still pass for Amazon's envelope domain, but it will not align with your From domain for DMARC.

Use the record SES shows for the MAIL FROM subdomain: v=spf1 include:amazonses.com ~all. AWS documents this value for custom MAIL FROM.
Publish only one SPF TXT record at any one host. If your root domain already sends through Google Workspace, Microsoft 365, HubSpot, or another service, merge senders into one SPF record instead of adding a second one.
Watch the SPF 10 DNS lookup limit from RFC 7208. include, a, mx, ptr, exists, and redirect mechanisms count. Too many nested vendors can make SPF return a permanent error.
Use ~all while you are proving the setup. A hard -all is stricter, but it can break real mail if you missed a sender. Move only when reports are clean.
Do not confuse the MAIL FROM MX with your normal mailbox MX. Your root domain can still use Google or Microsoft for replies. The MAIL FROM subdomain needs the single SES MX for bounces and complaints.

DKIM: let Easy DKIM carry DMARC

DKIM is the easiest DMARC path in SES because the signature can align with the visible From domain. It also survives many forwarding paths better than SPF.

Use SES Easy DKIM unless you have a strong reason to bring your own keys. SES signs mail for the verified identity after the DNS CNAMEs verify.
Check the DKIM signing domain. DMARC passes when DKIM passes and the d= domain aligns with the From domain. Relaxed alignment lets a subdomain align with the parent domain. Strict alignment requires the exact same domain.
Do not rotate or delete DKIM records during a live send without checking SES status. AWS warns that a pending Easy DKIM change can leave mail unsigned until DNS verifies.
If a receiving mailbox shows dkim=fail, compare the selector in the message header with the selector published in DNS. The selector is the s= value in the DKIM-Signature header.

DMARC: start with reports, then enforce

DMARC checks whether SPF or DKIM passes and aligns with the From domain. It also tells receivers what to do when both aligned checks fail.

Start with a record like v=DMARC1; p=none; rua=mailto:dmarc@example.com. This watches real traffic without asking receivers to quarantine or reject mail.
Read aggregate RUA reports before you enforce. They show which sources pass, which fail, and which domains align. If XML reports are hard to read, use the free DMARC report reader.
Move in steps: p=none, then p=quarantine, then p=reject. Use pct if you need a slower rollout.
Keep DMARC relaxed alignment unless you have a reason for strict alignment. SES custom MAIL FROM commonly uses a subdomain, and relaxed alignment fits that setup.
Remember that DMARC is a domain protection rule. It does not prove your campaign is wanted, clean, or safe. Gmail and Outlook still score reputation, complaints, bounces, links, volume, and user behavior.

Why mail still lands in spam after DNS passes

Authentication gets you into the conversation. It does not erase sender reputation. Gmail, Outlook, Yahoo, and business gateways still filter mail that looks risky or unwanted.

Check blocklists if delivery drops suddenly across many domains. A listed sending IP or domain can hurt placement even when SPF, DKIM, and DMARC pass.
Keep bounce and complaint rates low. SES can pause sending if complaints or bounces cross its limits, and mailbox providers use the same signals in their own filters.
Warm new sending patterns slowly. A sudden jump in SES volume from a new domain, new IP pool, or cold list is a spam signal.
Use a real reply address and working root-domain MX if people are meant to answer. For marketing mail, include a clear unsubscribe path and honor it fast.
Keep links, redirects, and tracking domains clean. A message signed by your domain can still look bad if it points to a flagged host.

Do not forget AI search visibility

If your setup docs, pricing page, or help center should appear in AI answers, crawlers must be able to fetch readable HTML. Email trust and search trust meet here because both depend on clear public records.

Allow the crawlers that decide live AI answer visibility: OAI-SearchBot for ChatGPT search, Claude-SearchBot for Claude, PerplexityBot for Perplexity, Googlebot for Google AI Overviews through the normal Search index, and Applebot for Apple Intelligence and Apple search features.
Disallowing those names in robots.txt removes that content from that engine's answers. Google has no separate AI Overviews opt-out crawler. Googlebot is the Search control.
Separate search crawlers from training controls. GPTBot, ClaudeBot, CCBot, Google-Extended, and Applebot-Extended are training or opt-out controls. Blocking them does not remove you from live AI-search visibility. Google-Extended and Applebot-Extended are robots-only control tokens with no separate crawl user-agent.
Treat robots.txt as stated policy, not proof of what happened in logs. Perplexity-User and Bytespider have been reported to ignore it, so log claims need evidence.
Serve the main answer in HTML, instead of relying only on client-side JavaScript. Googlebot documents JavaScript rendering. For other AI crawlers, JavaScript support is an undocumented risk, so server-rendered text is the safer choice. You can test the basics with the free AI visibility checker.

FAQ

Do I need a custom MAIL FROM domain for Amazon SES DMARC?

No. DMARC can pass through aligned DKIM alone, and Easy DKIM is the usual SES fix. A custom MAIL FROM domain is still worth doing because it gives you SPF alignment, branded bounce handling, and one less reason for a receiver to distrust the mail.

What SPF record should I use for Amazon SES?

For a custom MAIL FROM domain, AWS shows v=spf1 include:amazonses.com ~all as the TXT value. Put it on the MAIL FROM subdomain, not blindly on the root domain. If the same host already has SPF, merge records into one.

How long does SES DKIM or MAIL FROM verification take?

Many DNS changes verify in minutes, but AWS says DKIM and MAIL FROM checks can take up to 72 hours in some cases. Keep sending volume low until SES shows the identity and MAIL FROM domain as verified.

Should I publish p=reject right away?

Usually no. Start at p=none, collect RUA reports, fix every real sender, then move to quarantine and reject. Going straight to reject can block payroll, billing, support, or CRM mail you forgot about.

Where can I read the primary rules?

Use the provider docs for steps and the RFCs for the rules: AWS SES Easy DKIM, AWS custom MAIL FROM, RFC 7208 for SPF, RFC 6376 for DKIM, RFC 7489 for DMARC, plus Google and Microsoft sender guidelines. For AI crawler rules, use the OpenAI, Anthropic, Perplexity, Google, Apple, and Common Crawl docs. Related deliverability guides live at InboxRadar guides.