How to Set Up SPF for Amazon SES

Authorize Amazon SES to send email on behalf of your domain by adding the correct SPF include for your SES region.

Quick Answer — The Record You Need

Record Type

TXT

Host / Name

Value

v=spf1 include:amazonses.com ~all

The include:amazonses.com covers all AWS SES regions.

Step-by-Step Setup

Sign in to the AWS Console

Go to the AWS Management Console and navigate to the Amazon SES service in your sending region.

Verify your domain

Under Configuration > Verified identities, click "Create identity" and add your domain. SES will provide DNS records.

Check your existing SPF record

Check if you already have an SPF record.

dig TXT yourdomain.com +short | grep spf

Add Amazon SES to your SPF record

Add include:amazonses.com to your existing SPF record.

v=spf1 include:amazonses.com ~all

Enable custom MAIL FROM (recommended)

In SES, set a custom MAIL FROM domain (e.g., mail.yourdomain.com). This improves SPF alignment for DMARC. Add the SPF record to the MAIL FROM subdomain as well.

mail.yourdomain.com  TXT  "v=spf1 include:amazonses.com ~all"

Before & After

Before

v=spf1 include:_spf.google.com ~all

After

v=spf1 include:_spf.google.com include:amazonses.com ~all

Common Gotchas

Amazon SES uses a default MAIL FROM of amazonses.com, which will not align with your domain for DMARC SPF. Set a custom MAIL FROM domain to achieve SPF alignment.
The include:amazonses.com covers all SES regions. You do not need region-specific includes.
If you configure a custom MAIL FROM domain, you need an SPF record on that subdomain AND an MX record pointing to feedback-smtp.<region>.amazonses.com.

Verify Your Setup

After adding your DNS records, use our free SPF checker to verify everything is configured correctly. DNS changes typically propagate within minutes, but can take up to 48 hours.

Frequently Asked Questions

What SPF record do I need for Amazon SES?

Add include:amazonses.com to your SPF record. For DMARC alignment, also configure a custom MAIL FROM domain in SES and add the SPF record there.

Do I need different SPF records for different SES regions?

No. The include:amazonses.com covers all AWS SES regions. One include is sufficient.

What is a custom MAIL FROM domain in Amazon SES?

A custom MAIL FROM domain (e.g., mail.yourdomain.com) replaces the default amazonses.com envelope sender. This is required for SPF alignment under DMARC.