DNS Records for Email: MX, SPF, DKIM and DMARC Setup

To send and receive email from your own domain on Amazon SES, you publish up to eight DNS records: three DKIM CNAMEs (required), one MX record for incoming mail, one SPF TXT record, one DMARC TXT record, and an MX plus SPF pair on a mail subdomain for a custom MAIL FROM. The values below are exactly what Mailmark generates for every domain; <region> is the AWS Region shown on your domain page, and the DKIM tokens are unique to your domain.

The full record set

Copy the exact values from Dashboard > Domains > your domain. Two details trip people up:

• The receiving MX is on amazonaws.com, the MAIL FROM MX is on amazonses.com. They are different endpoints. Swapping them is the most common copy-paste error.
• The number 10 is the MX priority. Many DNS providers have a separate priority field: put 10 there and only the hostname in the value field.

Step 1: Add the 3 DKIM CNAME records

DKIM signs every message so receivers can check it really came from your domain and wasn't changed in transit. SES uses Easy DKIM: you publish three CNAME records, each pointing at a key AWS manages, and SES signs with a 2048-bit key by default. Gmail requires a DKIM key of at least 1024 bits, so the default is fine.

These CNAMEs are also how SES confirms you own the domain. Until all three resolve, the domain can't send.

Enter the host exactly as shown. AWS's verification troubleshooting lists the usual mistakes:

• Your provider appends the domain for you. If you type abc123._domainkey.example.com into a provider that adds the domain itself, the record ends up at abc123._domainkey.example.com.example.com. Enter only abc123._domainkey, or add a trailing dot to mark the name as complete.
• No extra underscore. abc123._domainkey is correct, _abc123._domainkey is not.
• The underscore is required. A few DNS providers reject underscores in names; their support team has to add the record.

Step 2: Point MX at SES to receive mail

The MX record tells other mail servers where to deliver mail sent to your domain. For Mailmark mailboxes to receive mail, publish one MX on the root (@) with priority 10 and value inbound-smtp.<region>.amazonaws.com.

Step 3: Publish one SPF record

SPF lists the servers allowed to send mail for your domain. The rule that matters most: a domain must not have more than one SPF record. Two v=spf1 TXT records make SPF return a permerror, which fails it for every sender.

If you already send through another provider, add SES to the existing record instead of creating a second one. With Google Workspace, whose own value is v=spf1 include:_spf.google.com ~all, the merged record is:

v=spf1 include:amazonses.com include:_spf.google.com ~all

Mailmark does this merge for you: when your domain already has an SPF record, the domain page shows the combined value to replace it with.

Keep an eye on the 10 DNS lookup limit. Every include, a, mx, ptr, and exists mechanism, plus redirect, counts, including the lookups inside each include. Past 10, SPF fails with a permerror. Remove includes for services you no longer use before adding new ones.

Step 4: Publish a DMARC record

DMARC tells receivers what to do with mail that fails authentication and where to send reports. Start with monitoring only:

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

This is no longer optional for bulk mail. Google requires SPF, DKIM, and DMARC from anyone sending 5,000 or more messages a day to Gmail accounts, and p=none is enough to comply. Yahoo's rules are the same. DMARC only passes when SPF or DKIM passes for a domain that matches your From address. Easy DKIM signs as your own domain, which gives you DKIM alignment out of the box.

For what each policy does and how to read the reports, see SPF, DKIM, and DMARC explained.

Step 5: Set up the MAIL FROM subdomain

By default SES uses an amazonses.com address as the envelope sender (the bounce address), so SPF passes for Amazon's domain, not yours. A custom MAIL FROM domain on a subdomain you own makes SPF pass for your domain too, which gives DMARC a second aligned check besides DKIM. Mailmark uses mail.yourdomain.com:

• MX: mail with value 10 feedback-smtp.<region>.amazonses.com. Publish exactly one MX on this subdomain; AWS says the setup fails if there are several.
• TXT: mail with value v=spf1 include:amazonses.com ~all.

AWS keeps checking for the MX record for up to 72 hours. If the MX is missing, SES falls back to its default MAIL FROM domain rather than blocking your mail.

Verify the records

Check what the world actually sees before clicking anything. With dig (swap in your domain, region, and one of your DKIM tokens):

dig +short CNAME abc123._domainkey.yourdomain.com   # -> abc123.dkim.amazonses.com.
dig +short MX yourdomain.com                       # -> 10 inbound-smtp.<region>.amazonaws.com.
dig +short TXT yourdomain.com                      # exactly one "v=spf1 ..." string
dig +short TXT _dmarc.yourdomain.com               # "v=DMARC1; p=none; ..."
dig +short MX mail.yourdomain.com                  # one record, feedback-smtp.<region>.amazonses.com.

When they all resolve, click Verify DNS on the domain page. AWS notes that DNS changes can take up to 72 hours to propagate, though most resolve within minutes. The free deliverability checker runs the same SPF, DKIM, DMARC, MX, and blacklist checks from the outside.

Troubleshooting

Once the records pass, the next step is keeping your reputation healthy: see the email deliverability guide. For the full product walkthrough, including bring-your-own-AWS domains, see the domain setup docs.

Frequently asked questions

Do I need all of these DNS records?+

The 3 DKIM CNAMEs are required: they prove you own the domain and sign your mail. The MX record is needed only if the domain should receive mail. SPF, DMARC, and the MAIL FROM records are optional for sending, but Gmail and Yahoo require SPF, DKIM, and DMARC from bulk senders, so publish them all.

How long does DNS verification take?+

Usually minutes, but AWS says DNS changes can take up to 72 hours to propagate. If a record still fails after that, check it with dig before changing anything else.

Can I keep Google Workspace or Microsoft 365 on the same domain?+

For sending, yes: merge both providers into one SPF record. For receiving, no: a domain's MX records decide where its mail goes, so pointing MX at SES moves incoming mail away from your current provider.

Why does SES need three DKIM records?+

Easy DKIM publishes three CNAMEs per domain, each pointing at a key that AWS manages. You never copy a public key yourself, and SES signs every message with a 2048-bit key by default.

Should my DMARC policy be p=none or p=reject?+

Start with p=none and read the aggregate reports. Once every legitimate sender passes SPF or DKIM in alignment, move to p=quarantine and then p=reject.