How to Set Up DMARC for Amazon SES

Publish a DMARC record to protect your domain when using Amazon SES, ensuring proper alignment of SPF and DKIM.

Quick Answer — The Record You Need

Record Type

TXT

Host / Name

_dmarc

Value

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

For DMARC to fully pass, configure a custom MAIL FROM domain (for SPF alignment) and Easy DKIM.

Step-by-Step Setup

Configure Easy DKIM

Set up Easy DKIM with the three CNAME records. This gives you DKIM alignment.

Set a custom MAIL FROM domain

In SES, configure a custom MAIL FROM domain (e.g., mail.yourdomain.com) with its own SPF record and MX record. This gives you SPF alignment.

Create the DMARC record

Add a TXT record at _dmarc.yourdomain.com.

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Test and verify alignment

Send test emails via SES and check headers for dmarc=pass with both SPF and DKIM alignment.

Enforce gradually

Move from p=none to p=quarantine to p=reject over several weeks.

Common Gotchas

Without a custom MAIL FROM domain, SES uses amazonses.com as the envelope sender, which fails SPF alignment. You will rely solely on DKIM alignment for DMARC.
SES sends email from the region where the identity is configured. Ensure your domain is verified in the correct region.
If you use SES in multiple regions, verify your domain in each region separately. DKIM CNAMEs are the same across regions, but verification is per-region.

Verify Your Setup

After adding your DNS records, use our free DMARC checker to verify everything is configured correctly. DNS changes typically propagate within minutes, but can take up to 48 hours.

Frequently Asked Questions

Why do my SES emails fail DMARC SPF alignment?

By default, SES uses amazonses.com as the MAIL FROM (envelope sender), which does not align with your domain. Set a custom MAIL FROM domain in SES to fix this.

Is DKIM enough for DMARC with Amazon SES?

Yes. DMARC requires either SPF or DKIM to pass and align. Easy DKIM provides DKIM alignment, which is sufficient. However, setting up both SPF and DKIM alignment is best practice.

Do I need a DMARC record for each SES region?

No. DMARC is a per-domain DNS record, not per-region. One DMARC record on your domain covers all email sent from any SES region.