SPF, DKIM and DMARC for Amazon SES

The DNS records Amazon SES needs so your mail is authenticated and stays out of spam.

SPF	—	SPF goes on a custom MAIL FROM subdomain (for example `mail.yourdomain.com`) with `v=spf1 include:amazonses.com ~all`, not on your root domain.
DKIM	CNAME / TXT	Easy DKIM: three CNAME records `<token>._domainkey` → `<token>.dkim.amazonses.com`.
DMARC	TXT at `_dmarc`	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com Start with `p=none` and a mailbox you read; build your own.

Step by step

In the SES console open Identities → Create identity → Domain and keep Easy DKIM (RSA 2048) selected.
Publish the three DKIM CNAMEs SES shows. With Route 53 SES can add them for you.
Under the identity's Custom MAIL FROM domain pick a subdomain, then add its MX record 10 feedback-smtp.<region>.amazonses.com and the SPF TXT record above on that subdomain.
Publish DMARC at your root domain.
Request production access if the account is still in the SES sandbox.

Without a custom MAIL FROM domain, SPF passes for amazonses.com only, so it does not align. DKIM still carries DMARC, but you lose the backup.
The MAIL FROM MX record must use the same region your SES identity lives in.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 19-page guide, checklist, 20+ providers.