Set up SPF alignment for Amazon SES
The exact steps in the Amazon SES admin console, followed by a checker to confirm the record resolves once you publish it.
Steps
- By default SES uses its own amazonses.com MAIL FROM domain, which means SPF authenticates against Amazon, not you. So SPF does not align for DMARC even though it passes.
- To fix alignment, set a Custom MAIL FROM domain (for example mail.yourdomain.com) under the identity's settings.
- Publish the MX and SPF (TXT) records SES gives you for that subdomain: the SPF value will include amazonses.com.
- With a custom MAIL FROM in place, SPF aligns with your domain and can satisfy DMARC on its own. DKIM alignment works regardless, so this step matters most if you rely on SPF for DMARC.
Confirm it workedSPF checker
DNS changes take time to propagate. Check the record once you have published it.