.png)
Setting up SPF and DKIM in Amazon SES ensures your emails pass DMARC alignment and reduces spam.
SPF (Sender Policy Framework) is a DNS TXT record that lists the servers authorized to send email for your domain. Amazon SES uses SPF to prove that its IP addresses are permitted to send on your behalf, helping receiving servers trust your messages. Without a proper SPF record, emails from SES may fail DMARC alignment and land in spam folders. Adding the correct SPF entry ensures higher deliverability and protects against spoofing. Check your SPF alignment with Palisade.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing email, allowing receivers to verify that the content wasn’t altered in transit. Amazon SES generates a public‑key pair and provides CNAME records you publish in DNS. When a recipient validates the signature, it confirms the email truly originated from your domain. This boosts trust and improves inbox placement. Test your DKIM setup with Palisade.
Log in to the AWS Management Console, navigate to Amazon SES, and select “Configuration > Verified identities.” Here you’ll see a list of domains and their authentication status. Look for DKIM signing status and the “MAIL FROM” domain field. This page shows whether SPF and DKIM are currently active or need configuration. Use it as your starting point before making DNS changes.
In the SES console, click on a verified domain and choose the “Authentication” tab. Amazon SES will display three unique CNAME records for DKIM. Copy each Name and Value exactly as shown. These records point to Amazon’s DKIM service and must be added to your DNS zone unchanged.
For each of the three CNAME records, create a new DNS entry in Cloudflare:
._domainkey.yourdomain.com.dkim.amazonses.com valueRepeat this for all three records, then wait up to 72 hours for propagation.
From the “Verified identities” list, select your domain and click “Set MAIL FROM domain.” Choose a subdomain you control (e.g., mail.yourdomain.com) and save. Amazon SES will then provide a TXT record for SPF and an MX record for bounce handling. Adding these records ties the Return‑Path to your brand domain, allowing SPF alignment.
After you specify the subdomain, SES shows two DNS entries:
v=spf1 include:amazonses.com -allfeedback-smtp..amazonses.com Enter both in Cloudflare (or your DNS provider) using “DNS Only” mode. Once saved, refresh the SES console to see a green “Successful” banner.
Most DNS changes propagate within minutes, but full global propagation can take up to 72 hours. You can use Palisade’s DNS lookup tool to check whether your records are visible worldwide. Until the records are fully propagated, the SES console may still show “Pending.”
Yes. Amazon SES is region‑specific, so SPF/DKIM settings must be configured in every region where you send mail (e.g., US‑East‑1 and US‑East‑2). Each region will generate its own set of CNAME, TXT, and MX records. Skipping a region can cause authentication failures for emails sent from that location.
Return to the SES console and look for green checkmarks next to DKIM and “MAIL FROM domain.” You can also send a test email to a Gmail or Outlook address and view the full email headers. Look for “spf=pass” and “dkim=pass” results. Finally, run a DMARC report through Palisade to confirm alignment.
Palisade offers an Email Security Score that scans SPF, DKIM, and DMARC for any domain. Additionally, free services like MXToolbox and Google’s Message Header Analyzer provide quick checks. Regularly monitoring these scores helps catch misconfigurations before they affect deliverability.
Palisade continuously checks your DNS records, alerts you to failures, and provides a visual dashboard of authentication health. The platform also offers step‑by‑step remediation guidance, so you can fix issues fast. By integrating Palisade, you maintain a strong email reputation and reduce the risk of spoofing attacks.
Yes. Amazon SES creates DKIM records for the exact domain you verify, but you can also verify a subdomain and publish its CNAMEs. This is useful for separating marketing and transactional traffic.
Append include:amazonses.com to your existing SPF string before the -all qualifier. Ensure you stay under the 10‑lookup limit for SPF.
Yes. The same CNAME, TXT, and MX records must be added to the new provider’s DNS zone. The values themselves do not change.
No. DKIM signing is performed by Amazon SES servers and adds only a few milliseconds to the send process.
Review whenever you add a new sending service, change DNS providers, or notice deliverability issues. A quarterly audit using Palisade’s dashboard is a good practice.
.svg)