Email identities are domains you send emails from. You must verify domain ownership before sending emails through AWS SES.
- Navigate to Email Identities > Create identity.
Enter your domain (e.g.,
example.com), and click Create
- Open the identity, copy DKIM CNAME records, add to your DNS provider (verification typically takes 5-10 minutes, up to 72 hours)
- After verification, go to Senders tab > Add sender, enter email address using your domain (e.g.,
hello@example.com) and optional display name
DKIM verification is required before sending emails.
DomainKeys Identified Mail (DKIM)
DKIM prevents email spoofing by adding digital signatures to email headers. AWS SES generates cryptographic keys: the public key is published in DNS, and emails are signed with the private key.
Setup
AWS SES generates three DKIM CNAME tokens. Add all three records to your DNS provider:
| Field | Value |
|---|
| Type | CNAME |
| Name | {token}._domainkey.example.com |
| Value | {token}.dkim.amazonses.com |
Mail FROM Domain
The Mail FROM domain appears in the email’s envelope, separate from the “From” header recipients see.
Benefits
Configuring a custom Mail FROM domain instead of AWS default (amazonses.com):
- Improves deliverability through domain alignment
- Enables SPF alignment for DMARC
- Maintains brand consistency
- Controls sending reputation
Setup
- Authentication tab > Mail FROM > Enable
- Enter subdomain (e.g.,
mail)
- Choose MX failure behavior (recommend: Use default value)
- Add DNS records:
| Field | Value |
|---|
| Type | MX |
| Name | mail.example.com |
| Priority | 10 |
| Value | feedback-smtp.{region}.amazonses.com |
| Field | Value |
|---|
| Type | TXT |
| Name | mail.example.com |
| Value | v=spf1 include:amazonses.com ~all |
Mail FROM is highly recommended but optional for production sending.
DMARC
DMARC builds on SPF and DKIM, telling email servers how to handle failed authentication.
Benefits
- Prevents phishing using your domain
- Improves deliverability with major providers
- Provides visibility into email sending
- May be required for compliance
Setup
Add TXT record to your DNS provider:
| Field | Value |
|---|
| Type | TXT |
| Name | _dmarc.example.com |
| Value | v=DMARC1; p=none; |
p=):
none: Monitor only (start here)quarantine: Send suspicious emails to spamreject: Block failed emails
Start with p=none, then gradually move to p=quarantine and p=reject
after reviewing reports.
