Configure Amazon SES for DMARC alignment

Amazon SES passes DMARC through DKIM. SES offers two DKIM options: Easy DKIM (SES manages the keys, you publish CNAME records) and BYODKIM (Bring Your Own DKIM, where you provide a 1024 or 2048-bit key). Both work for DMARC alignment.

Verify a domain identity in SES

Before SES will send mail on behalf of your domain, you must verify the domain identity.

1. Go to Amazon SES > Verified identities and click Create identity.
2. Select Domain, enter your domain, and choose your DKIM configuration.
3. If you select Easy DKIM, SES generates three CNAME records to publish.
4. Publish the records, then return to SES and wait for verification (usually a few minutes).

Easy DKIM

Easy DKIM uses CNAME records pointing to SES infrastructure, similar to SendGrid's approach. SES rotates the underlying keys automatically.

The records look like:

abc123._domainkey.yourdomain.com  CNAME  abc123.dkim.amazonses.com
def456._domainkey.yourdomain.com  CNAME  def456.dkim.amazonses.com
ghi789._domainkey.yourdomain.com  CNAME  ghi789.dkim.amazonses.com

SES publishes three selectors and rotates between them. After verification and DKIM signing is enabled, outbound mail is signed with d=yourdomain.com.

BYODKIM

BYODKIM lets you provide your own RSA private key (minimum 1024-bit, recommended 2048-bit). You provide the public key as a TXT record at a selector you choose:

yourselector._domainkey.yourdomain.com  TXT  "v=DKIM1; k=rsa; p=MIGf..."

You're responsible for key rotation with BYODKIM. The advantage is that you control the key material and can use the same key with multiple senders if needed.

SPF for Amazon SES

SES sets the Return-Path to amazonses.com by default unless you configure a custom MAIL FROM domain. Without a custom MAIL FROM:

• SPF passes for amazonses.com (SES is authorized to send from that domain)
• SPF alignment fails because amazonses.com doesn't match yourdomain.com

To get SPF alignment, configure a custom MAIL FROM domain:

1. In SES Verified Identities, select your domain and click Edit in the DKIM and identity settings.
2. Under Custom MAIL FROM domain, enter a subdomain: bounces.yourdomain.com.
3. SES provides an MX record and a TXT record to publish at bounces.yourdomain.com.

bounces.yourdomain.com  MX  10 feedback-smtp.us-east-1.amazonses.com
bounces.yourdomain.com  TXT "v=spf1 include:amazonses.com ~all"

Once configured, SES uses bounces.yourdomain.com as the envelope sender. The subdomain shares the organizational domain with yourdomain.com, passing SPF alignment under relaxed mode.

With Easy DKIM or BYODKIM active, DKIM alone provides DMARC alignment. Configuring custom MAIL FROM adds SPF as a second alignment path.

Sending from multiple AWS regions

If you use SES in multiple regions (for example, us-east-1 and eu-west-1), you need to verify the domain identity separately in each region. The CNAME records for Easy DKIM are different per region, so you'll end up with multiple CNAME sets in your DNS, one per region.

Custom MAIL FROM configuration is also per-region. Each region's feedback-smtp endpoint is different; configure MX records per region or use a catch-all approach.

What to expect in DMARCdrift

With DKIM configured and the domain verified:

• Source: Amazon SES IP ranges (shared infrastructure; multiple senders use these IPs)
• DKIM result: pass, d=yourdomain.com
• SPF result: pass if you configured a custom MAIL FROM; fail otherwise
• DMARC result: pass (DKIM alignment is sufficient)

SES IP addresses are shared across many AWS customers. Seeing unfamiliar traffic from SES IPs in your reports doesn't necessarily mean it's your traffic. Look at the DKIM signing domain to attribute it to your SES-sent mail.

See also: DKIM alignment: how DKIM signing domain matching works. SPF alignment: why the envelope sender matters and where custom MAIL FROM helps.