How to Set Up DMARC for Amazon SES | SimpleDMARC

Why SES Setup Looks Different From Other Providers

Amazon SES isn't an inbox provider — it's usually handling transactional mail (receipts, password resets, notifications) alongside a separate business email provider like Microsoft 365 or Google Workspace. That combination is the normal case, not an edge case, so this guide assumes you might have two mail sources to account for, not just one.

Before anything else: SES requires you to verify a domain identity before it'll send mail at all. If you haven't done that in the SES console under Verified identities, start there — DKIM signing depends on it.

Step 1Generating Your DMARC Record

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-reports@yourdomain.com; fo=1; adkim=r; aspf=r; pct=100

p=none keeps everything in monitor mode. This matters particularly here — if SES handles transactional mail separately from your main provider, you want to see both sources cleanly in reports before enforcing anything.

Step 2Configure SPF for Amazon SES

If SES is genuinely your only mail source:

v=spf1 include:amazonses.com ~all

More commonly, SES handles transactional mail while another provider handles everything else:

v=spf1 include:amazonses.com include:spf.protection.outlook.com ~all

Step 3Enable DKIM in the SES Console

Select your verified domain identity, find the DKIM section, and enable Easy DKIM — Amazon's managed signing. This generates three CNAME records to publish in your DNS. If your domain is on Route 53, SES can often publish these automatically during verification; otherwise, add them manually wherever your DNS actually lives.

Step 4Wait for Enforcement (Monitor First)

Give it one to two weeks before touching policy. Check reports for:

• SES-sent transactional mail passing cleanly
• Your primary business mail provider passing separately
• Anything unrecognized that shouldn't be sending as your domain

Once both sources look clean, move to p=quarantine, then p=reject, by updating the same record.

Step 5Verify Your Setup

• Confirm the record with a DMARC Checker
• Check your "From" domain in SES sending configuration matches the domain your SPF and DKIM are aligned to — a mismatch here causes DMARC to fail even when both mechanisms technically pass
• Send a real test message through SES and separately through your other provider, checking authentication results for both.