Set up DMARC with Amazon SES

Amazon SES authenticates properly from the basic setup — but with the default settings, your SPF will never align. That is the point most SES configurations miss, and it only shows up in the reports.

Easy DKIM

Three CNAMEs, generated by SES when you verify the domain:

._domainkey  CNAME  .dkim.amazonses.com
._domainkey  CNAME  .dkim.amazonses.com
._domainkey  CNAME  .dkim.amazonses.com

SES then signs every message with a 2048-bit key, with nothing further to do. The tokens are specific to your domain identity: they do not carry over between accounts.

The MAIL FROM domain, the part everyone skips

By default, SES sends with its own envelope address, on amazonses.com. SPF therefore passes — those really are Amazon’s servers — but it validates Amazon’s domain, not yours. For DMARC, that is an alignment failure.

SES provides the answer: declare a custom MAIL FROM domain, a subdomain of your own, for example mail.yourdomain.com. It needs two records:

• an MX record, to receive the bounces and complaints providers send back to you;
• a TXT SPF record specific to that subdomain, authorising SES.

From then on the envelope address is a subdomain of yours, and relaxed alignment matches it against the From: domain. SPF and DKIM both align.

DMARC

Publish the monitoring policy on _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:your-address@yourdomain.com

Only tighten once every sender is identified. The progression, step by step.

Common mistakes with Amazon SES

• Stopping at Easy DKIM. Sending works, DMARC passes on DKIM alone, and the day a forward breaks the signature there is nothing left to fall back on.
• Forgetting the MX on the MAIL FROM subdomain. Bounces then go nowhere: you lose visibility on dead addresses, and your reputation with it.
• The sandbox. A new SES account can only write to verified addresses; leaving the sandbox is a separate request.
• Identities are per-region. A domain verified in one region is not verified in another — and the DKIM tokens differ.

Once it is in place, Clarsend reads your reports and shows you what passes, what fails, and who is sending without your knowledge.