Official DNS Guide • Cloud Infrastructure & High-Volume Delivery

Amazon Simple Email Service (SES) SPF Record Setup & Validator

Complete guide for Amazon SES SPF configuration, custom MAIL FROM domain setup, and Easy DKIM CNAME generation.

Quick Answer • Exact Amazon SES SPF Syntax

To authorize Amazon Simple Email Service (SES) to send emails on behalf of your domain, add include:amazonses.com to your domain's single DNS TXT SPF record before the terminating ~all mechanism. The standard record is v=spf1 include:amazonses.com ~all.

Live Amazon SES DNS Validator

Test your domain's published SPF, DKIM, and DMARC records via global DoH edge nodes in real time.

Zero-Log Client Evaluation

Understanding Amazon Simple Email Service (SES) Email Authentication

Amazon SES requires a Custom MAIL FROM subdomain (e.g. mail.yourdomain.com) with Easy DKIM for full DMARC compliance.

When Amazon Simple Email Service (SES) delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Amazon Simple Email Service (SES)'s IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.

Required DNS Records for Amazon SES

Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):

TypeHost / NameValue / TargetTTLPurpose
TXTmailv=spf1 include:amazonses.com ~all3600Custom MAIL FROM SPF.

Step-by-Step Setup Instructions

1

In AWS Console > Amazon SES > Verified Identities > Select domain.

2

Copy the 3 Easy DKIM CNAME records and add them to DNS.

3

Set Custom MAIL FROM domain (e.g. mail.yourdomain.com).

4

Publish MX and SPF records for the subdomain.

Common Amazon SES SPF Configuration Mistakes

× Shared Return-Path DMARC Fail

Cause: Using default MAIL FROM.

Fix: Configure Custom MAIL FROM subdomain.

Frequently Asked Questions

Why does SES use 3 CNAME records?

To support automated background key rotation.