---
title: "DNS Records for Email: MX, SPF, DKIM and DMARC Setup"
description: "Every DNS record your domain needs to send and receive email on Amazon SES: 3 DKIM CNAMEs, MX, SPF, DMARC, and MAIL FROM, with exact values and fixes."
source: "https://www.mailmark.dev/blog/dns-setup"
site: "Mailmark"
---

# DNS Records for Email: MX, SPF, DKIM and DMARC Setup

To send and receive email from your own domain on Amazon SES, you publish up to eight DNS records: three DKIM CNAMEs (required), one MX record for incoming mail, one SPF TXT record, one DMARC TXT record, and an MX plus SPF pair on a `mail` subdomain for a custom MAIL FROM. The values below are exactly what Mailmark generates for every domain; `<region>` is the AWS Region shown on your domain page, and the DKIM tokens are unique to your domain.

> **Get these records generated for your domain** Add a domain and Mailmark builds the full record set with your region and DKIM tokens filled in, merges your existing SPF record, and checks every record when you click Verify DNS. [Add your domain](https://www.mailmark.dev/?utm_source=guide&utm_medium=seo&utm_campaign=dns-setup&utm_content=top)

## The full record set

| Purpose | Type | Host / Name | Value | Needed? |
| --- | --- | --- | --- | --- |
| DKIM 1 to 3 | CNAME | `<token>._domainkey` | `<token>.dkim.amazonses.com` | Required |
| Receiving | MX | `@` | `10 inbound-smtp.<region>.amazonaws.com` | To receive mail |
| SPF | TXT | `@` | `v=spf1 include:amazonses.com ~all` | Recommended |
| DMARC | TXT | `_dmarc` | `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com` | Recommended |
| MAIL FROM | MX | `mail` | `10 feedback-smtp.<region>.amazonses.com` | Recommended |
| MAIL FROM SPF | TXT | `mail` | `v=spf1 include:amazonses.com ~all` | Recommended |

Copy the exact values from **Dashboard > Domains > your domain**. Two details trip people up:

- **The receiving MX is on `amazonaws.com`, the MAIL FROM MX is on `amazonses.com`.** They are different endpoints. Swapping them is the most common copy-paste error.
- **The number 10 is the MX priority.** Many DNS providers have a separate priority field: put `10` there and only the hostname in the value field.

## Step 1: Add the 3 DKIM CNAME records

DKIM signs every message so receivers can check it really came from your domain and wasn't changed in transit. SES uses [Easy DKIM](https://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-dkim-easy.html): you publish [three CNAME records](https://docs.aws.amazon.com/ses/latest/dg/creating-identities.html), each pointing at a key AWS manages, and SES signs with a 2048-bit key by default. Gmail [requires a DKIM key of at least 1024 bits](https://support.google.com/a/answer/81126), so the default is fine.

These CNAMEs are also how SES confirms you own the domain. Until all three resolve, the domain can't send.

Enter the host exactly as shown. AWS's [verification troubleshooting](https://docs.aws.amazon.com/ses/latest/dg/creating-identities.html#troubleshooting-domain-verification) lists the usual mistakes:

- **Your provider appends the domain for you.** If you type `abc123._domainkey.example.com` into a provider that adds the domain itself, the record ends up at `abc123._domainkey.example.com.example.com`. Enter only `abc123._domainkey`, or add a trailing dot to mark the name as complete.
- **No extra underscore.** `abc123._domainkey` is correct, `_abc123._domainkey` is not.
- **The underscore is required.** A few DNS providers reject underscores in names; their support team has to add the record.

## Step 2: Point MX at SES to receive mail

The MX record tells other mail servers where to deliver mail sent to your domain. For Mailmark mailboxes to receive mail, publish one MX on the root (`@`) with [priority 10 and value `inbound-smtp.<region>.amazonaws.com`](https://docs.aws.amazon.com/ses/latest/dg/receiving-email-mx-record.html).

> **This moves your incoming mail:** A domain's MX records decide where all of its incoming mail goes. If this domain currently receives mail in Google Workspace or Microsoft 365, replacing the MX records moves that mail to Mailmark. Remove the old MX records when you switch, or the old provider keeps receiving some of it.

## Step 3: Publish one SPF record

SPF lists the servers allowed to send mail for your domain. The rule that matters most: [a domain must not have more than one SPF record](https://datatracker.ietf.org/doc/html/rfc7208#section-3.2). Two `v=spf1` TXT records make SPF return a `permerror`, which fails it for every sender.

If you already send through another provider, add SES to the existing record instead of creating a second one. With Google Workspace, whose own value is [`v=spf1 include:_spf.google.com ~all`](https://knowledge.workspace.google.com/admin/security/set-up-spf), the merged record is:

```text
v=spf1 include:amazonses.com include:_spf.google.com ~all
```

Mailmark does this merge for you: when your domain already has an SPF record, the domain page shows the combined value to replace it with.

Keep an eye on the [10 DNS lookup limit](https://datatracker.ietf.org/doc/html/rfc7208#section-4.6.4). Every `include`, `a`, `mx`, `ptr`, and `exists` mechanism, plus `redirect`, counts, including the lookups inside each include. Past 10, SPF fails with a `permerror`. Remove includes for services you no longer use before adding new ones.

## Step 4: Publish a DMARC record

DMARC tells receivers what to do with mail that fails authentication and where to send reports. Start with monitoring only:

```text
_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"
```

This is no longer optional for bulk mail. Google requires SPF, DKIM, and DMARC from anyone sending [5,000 or more messages a day to Gmail accounts](https://support.google.com/a/answer/81126), and `p=none` is enough to comply. [Yahoo's rules](https://senders.yahooinc.com/best-practices/) are the same. DMARC only passes when SPF or DKIM passes for a domain that matches your From address. Easy DKIM signs as your own domain, which gives you DKIM alignment out of the box.

For what each policy does and how to read the reports, see [SPF, DKIM, and DMARC explained](/blog/understanding-spf-dkim-and-dmarc).

## Step 5: Set up the MAIL FROM subdomain

By default SES uses an `amazonses.com` address as the envelope sender (the bounce address), so SPF passes for Amazon's domain, not yours. A [custom MAIL FROM domain](https://docs.aws.amazon.com/ses/latest/dg/mail-from.html) on a subdomain you own makes SPF pass for your domain too, which gives DMARC a second aligned check besides DKIM. Mailmark uses `mail.yourdomain.com`:

- **MX:** `mail` with value `10 feedback-smtp.<region>.amazonses.com`. Publish exactly one MX on this subdomain; AWS says the setup fails if there are several.
- **TXT:** `mail` with value `v=spf1 include:amazonses.com ~all`.

AWS keeps checking for the MX record for up to 72 hours. If the MX is missing, SES falls back to its default MAIL FROM domain rather than blocking your mail.

## Verify the records

Check what the world actually sees before clicking anything. With `dig` (swap in your domain, region, and one of your DKIM tokens):

```bash
dig +short CNAME abc123._domainkey.yourdomain.com   # -> abc123.dkim.amazonses.com.
dig +short MX yourdomain.com                       # -> 10 inbound-smtp.<region>.amazonaws.com.
dig +short TXT yourdomain.com                      # exactly one "v=spf1 ..." string
dig +short TXT _dmarc.yourdomain.com               # "v=DMARC1; p=none; ..."
dig +short MX mail.yourdomain.com                  # one record, feedback-smtp.<region>.amazonses.com.
```

When they all resolve, click **Verify DNS** on the domain page. AWS notes that DNS changes can take [up to 72 hours to propagate](https://docs.aws.amazon.com/ses/latest/dg/creating-identities.html), though most resolve within minutes. The free [deliverability checker](/tools/email-deliverability-checker) runs the same SPF, DKIM, DMARC, MX, and blacklist checks from the outside.

> **Records verified? Keep them that way** Mailmark keeps checking SPF, DKIM, and DMARC on every domain and scans blacklists, so a record someone deletes during a DNS cleanup shows up before your mail starts failing. [Monitor your domains](https://www.mailmark.dev/?utm_source=guide&utm_medium=seo&utm_campaign=dns-setup&utm_content=middle)

## Troubleshooting

| Symptom | Likely cause | Fix |
| --- | --- | --- |
| DKIM still pending after 72 hours | Host saved as `token._domainkey.yourdomain.com.yourdomain.com` | Enter only `token._domainkey`, or end the name with a dot |
| DNS provider rejects the DKIM name | Provider doesn't allow underscores | Ask the provider's support to add it |
| SPF fails with `permerror` | Two SPF records, or more than 10 lookups | Merge into one record; remove includes you no longer use |
| Mail still arrives at your old provider | Old MX records left in place, or cached | Delete the old MX records and allow for their TTL to expire |
| MAIL FROM check fails | More than one MX record on `mail.yourdomain.com` | Keep exactly one MX on that subdomain |
| DMARC reports show SPF failing | MAIL FROM not set up, so SPF is checked against Amazon's domain | Publish the `mail` MX and TXT records |

Once the records pass, the next step is keeping your reputation healthy: see the [email deliverability guide](/blog/email-deliverability). For the full product walkthrough, including bring-your-own-AWS domains, see the [domain setup docs](/docs/domain-setup).

## Frequently asked questions

### Do I need all of these DNS records?

The 3 DKIM CNAMEs are required: they prove you own the domain and sign your mail. The MX record is needed only if the domain should receive mail. SPF, DMARC, and the MAIL FROM records are optional for sending, but Gmail and Yahoo require SPF, DKIM, and DMARC from bulk senders, so publish them all.

### How long does DNS verification take?

Usually minutes, but AWS says DNS changes can take up to 72 hours to propagate. If a record still fails after that, check it with dig before changing anything else.

### Can I keep Google Workspace or Microsoft 365 on the same domain?

For sending, yes: merge both providers into one SPF record. For receiving, no: a domain's MX records decide where its mail goes, so pointing MX at SES moves incoming mail away from your current provider.

### Why does SES need three DKIM records?

Easy DKIM publishes three CNAMEs per domain, each pointing at a key that AWS manages. You never copy a public key yourself, and SES signs every message with a 2048-bit key by default.

### Should my DMARC policy be p=none or p=reject?

Start with p=none and read the aggregate reports. Once every legitimate sender passes SPF or DKIM in alignment, move to p=quarantine and then p=reject.

> **One dashboard for every product domain** Add each product's domain, publish the generated records, and run mailboxes, inbox warming, and DNS monitoring for all of them from one place. [Try Mailmark free](https://www.mailmark.dev/?utm_source=guide&utm_medium=seo&utm_campaign=dns-setup&utm_content=end)


Published 2026-09-03. Updated 2026-10-22. 5 min read.

---

Mailmark - email hosting and campaigns for your own domain. Canonical page: https://www.mailmark.dev/blog/dns-setup | [llms.txt](https://www.mailmark.dev/llms.txt) | [OpenAPI](https://www.mailmark.dev/openapi.json) | [sitemap](https://www.mailmark.dev/sitemap.xml)