Prefer an authenticated identity

  • Verify the domain identity rather than relying only on an individual address.
  • Enable Easy DKIM or bring-your-own DKIM as appropriate.
  • Use the exact DNS records and region-specific values shown by SES.

Consider custom MAIL FROM

The default SES MAIL FROM domain is provider-owned and normally does not align with your visible From domain. A custom MAIL FROM subdomain can provide relaxed SPF alignment when its SPF check passes.

Note

Aligned DKIM alone is sufficient for DMARC, but two aligned paths provide resilience.

Check each region and application

An organisation may send through multiple AWS accounts, identities or regions. Inventory all of them and verify that the intended From domain receives an aligned signature.

Further readingAmazon SES DMARC guidance