Sending limits get your mail accepted by SES. Authentication gets it accepted by the recipient. Without these records a meaningful share of your mail will be filtered no matter how clean your list is.
What each record does
| Record | Answers |
|---|---|
| SPF | Is this server allowed to send for this domain? |
| DKIM | Was this message actually signed by the domain owner and unaltered? |
| DMARC | What should a receiver do when SPF and DKIM do not align? |
Deploy in this order
- Verify your domain in SES and publish the DKIM CNAME records it provides. Easy DKIM handles key rotation for you.
- Set a custom MAIL FROM domain, typically a subdomain such as
mail.example.com. This is what makes SPF align, and skipping it is the most common cause of DMARC failures on otherwise correct setups. - Publish SPF on the MAIL FROM domain including Amazon SES.
- Publish DMARC starting at
p=nonewith a reporting address, so you observe before you enforce. - Read the reports for a couple of weeks, confirm all legitimate sources pass, then move to
p=quarantineand eventuallyp=reject.
The alignment rule
DMARC does not just require SPF or DKIM to pass. It requires one of them to pass and align with the domain in the visible From address.
- SPF alignment compares the MAIL FROM domain with the From domain. Without a custom MAIL FROM domain, SES uses its own, so SPF passes but does not align.
- DKIM alignment compares the signing domain with the From domain. Signing with your own verified domain aligns.
This is why DKIM with a verified domain is the more robust path, and why the custom MAIL FROM subdomain is worth setting up rather than skipping.
Common mistakes
- Multiple SPF records on one domain. Only one is permitted; merge them.
- Exceeding the SPF lookup limit. SPF allows a limited number of DNS lookups; long include chains break silently.
- Publishing DMARC at enforcement immediately, which can block legitimate mail from systems you forgot about.
- Forgetting other senders. Your CRM, helpdesk and billing system all send as your domain and all need to align.
Do not stop at authentication
Authentication proves who sent the message. It does not make recipients want it. Bounce and complaint handling still determine whether SES keeps your limits, covered in bounce and complaint handling.
If you are sending directly from a server rather than through SES, the same records apply plus reverse DNS and IP warming. See SMTP port 25 across providers.
Our SES accounts are supplied already out of sandbox with production sending limits.
Common questions
Do I need both SPF and DKIM?
DMARC needs one aligned pass. Publishing both is standard practice and more resilient.
Why does DMARC fail when SPF passes?
Almost always missing alignment. Set a custom MAIL FROM domain.
How long before I enforce DMARC?
Long enough to see reports covering every legitimate sender, typically a few weeks.