Email senders · Amazon SES

How do I set up Amazon SES so its email passes DMARC?

Publish the records Amazon SES shows in your account for your domain.

Last read from the sources at the foot of this page.

Check my firm
01

What does Amazon SES ask me to publish?

when you verify a domain identity, you can send email from any subdomain or email address of the verified domain without having to verify each one individually.

Amazon SES makes the values for your account, so we do not print any here.

Amazon SES also gives MX records, for the replies and bounces it receives. Add them only at the name Amazon SES shows you, never at your domain itself: the MX records at your domain decide where all of your email is delivered.

02

Where in Amazon SES are my values shown?

On the Authentication tab of the identity details page, expand Publish DNS records .

In the Amazon SES console, go to Configuration, then Identities, choose your domain, open the Authentication tab and expand Publish DNS records.

Copy each value from there exactly as shown, and add each record at your DNS host.

03

Will p=reject block Amazon SES email?

If you want to use this SPF record as a way to comply with DMARC, the domain in the From address must match the MAIL FROM domain.

Not once Amazon SES signs your email with your domain's DKIM key. DMARC passes when a message passes DKIM or SPF for your own domain, and the DKIM records Amazon SES gives you are on your domain.

With a custom MAIL FROM domain, SPF counts toward DMARC only when the domain in the From address matches the MAIL FROM domain.

Before you raise your policy, read your DMARC reports and check that email from Amazon SES passes.

Sources

Where does this come from?

Related
05 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy