PROBLEM

Amazon SES DMARC Failing? Here's Why, and the Fix

SES-specific DMARC troubleshooting, not a generic DMARC explainer. Covers exactly why SES's defaults fail alignment and the precise DNS fix.

iQuick answer

Amazon SES fails DMARC almost always because of alignment, not a broken SPF or DKIM record, and SES's own defaults break both alignment paths at once. Fix SPF alignment with a custom MAIL FROM subdomain, and fix DKIM alignment by enabling Easy DKIM on your domain identity rather than an email-address identity, so mail is signed with your own domain instead of amazonses.com.

Why Amazon SES Fails DMARC Out of the Box

If Amazon SES DMARC is failing for you, the cause is almost always alignment, not a broken SPF or DKIM record. DMARC does not check SPF or DKIM directly. It checks whether the domain in your visible From address aligns with the domain that actually passed SPF or DKIM. Amazon SES's defaults break both alignment paths at once, which is why DMARC failing on SES is so common even when SPF and DKIM individually look fine.

The SPF path fails by default. Every message you send through Amazon SES automatically uses a subdomain of amazonses.com as its MAIL FROM, or envelope/Return-Path, domain, unless you configure your own. SPF passes against that amazonses.com subdomain since Amazon SES is authorized to send from it, but SPF-based DMARC alignment requires the domain in your From address to match the MAIL FROM domain. amazonses.com never matches yourdomain.com, so alignment fails even though SPF itself technically passed.

The DKIM path fails by default too, for a similar reason. Amazon SES signs your outgoing mail with d=amazonses.com whenever the sending identity is verified only as an email address, or when you have not enabled Easy DKIM for your own verified domain. DKIM-based alignment needs the signing domain to match your From domain, and again, amazonses.com does not match yours.

Since DMARC only needs one of SPF or DKIM to align, most senders only need to fix one path. But SES's defaults fail both simultaneously, which is exactly why a fresh SES setup so often reports a full DMARC failure rather than a partial one.

Fix 1: Set Up a Custom MAIL FROM Domain (Fixes SPF Alignment)

This is the fix for the SPF path. A custom MAIL FROM domain has specific rules: it must be a subdomain of the same parent domain as your verified identity, and it must not be a subdomain you also use to send or receive regular mail.

Setup requires exactly two DNS records, published to the MAIL FROM subdomain's own DNS, not your root domain: one MX record, priority 10, pointing at feedback-smtp.{your-region}.amazonses.com, and one SPF TXT record authorizing Amazon SES to send from that subdomain.

Two things trip people up here. First, you must publish exactly one MX record. If the subdomain has more than one, the whole setup fails. Second, there is a Behavior on MX failure setting you choose during configuration: Use default MAIL FROM domain silently falls back to the broken amazonses.com default if your MX record is not detected, meaning DMARC keeps failing with no visible error, while Reject message hard-fails the send instead. If you want a configuration mistake to be loud instead of silent, pick reject.

DNS propagation for this can take up to 72 hours. The setup state moves from Pending to Success, or Failed, if the MX record is never detected in that window.

Fix 2: Enable Easy DKIM for Your Domain (Fixes DKIM Alignment)

This is the fix for the DKIM path. Enable Easy DKIM on your domain identity, not just an email-address identity, so Amazon SES signs outgoing mail with your own domain instead of amazonses.com. Whether your DMARC alignment mode is relaxed or strict is a setting in your own domain's DMARC record, the aspf and adkim tags, checked by the receiving mail server. It is not something Amazon SES sets or defaults to. What SES does control is which domain it signs with, and signing with your exact verified domain satisfies alignment under either mode, so this fix works regardless of which alignment mode your DMARC record specifies.

Verifying the Fix

Check your domain's actual DMARC alignment settings from the command line:

dig TXT _dmarc.yourdomain.com

Look for the v=DMARC1 record. If it includes aspf=r, or has no aspf tag at all, your domain uses relaxed SPF alignment. If it includes adkim=r, or has no adkim tag, that is relaxed DKIM alignment. A missing tag still means the default applies; it isn't the same as having no policy at all.

If you are just starting a DMARC rollout rather than fixing an existing failure, do it in phases: p=none to monitor only, then p=quarantine, then p=reject. Moving straight to reject before you have confirmed alignment is clean is how legitimate mail gets silently dropped instead of just flagged.

?Frequently asked questions

Why does Amazon SES fail DMARC even when SPF passes?

SPF can pass against SES's own amazonses.com MAIL FROM domain while still failing DMARC alignment, because alignment requires the MAIL FROM domain to match your visible From-address domain, not just pass an SPF check on its own.

What is a custom MAIL FROM domain and why does Amazon SES need one?

It is your own subdomain used as the envelope or Return-Path address instead of SES's default amazonses.com subdomain. Without it, your SPF-based DMARC alignment fails by default.

Does Amazon SES support DKIM alignment for DMARC?

Yes, but only if Easy DKIM is enabled for your verified domain identity. Otherwise SES signs with d=amazonses.com, which will not align with your From domain.

Does Amazon SES set DMARC alignment mode, relaxed vs strict?

No. Alignment mode is defined by the aspf and adkim tags in your own domain's DMARC record and checked by the receiving mail server, not something Amazon SES has any control over as the sender. What SES does control is which domain it signs mail with. Easy DKIM signing with your own exact verified domain satisfies alignment under either mode.

What happens if my custom MAIL FROM domain's MX record is not detected?

Depends on your Behavior on MX failure setting. It either silently falls back to the broken amazonses.com default, so mail keeps failing DMARC with no visible error, or hard-rejects the message, depending on which option you chose during setup.

How long does a custom MAIL FROM domain take to verify?

Amazon SES checks for up to 72 hours after you publish the DNS records before marking the setup as Failed if the MX record still is not detected.

Your emails deserve the inbox.

Start free trial

Keep reading