DKIM record for Amazon SES

The DNS records

SES generates three random tokens for each identity. The hosted zone in the target varies by AWS Region and can differ between identities, so always copy the value SES shows rather than a fixed domain.

Easy DKIM, record 1 of 3 (AWS's example)

Type: CNAME · Host: hirjd4exampled5477y22yd23ettobi._domainkey Copy

hirjd4exampled5477y22yd23ettobi.dkim.us-west-2.amazonses.com

Records 2 and 3 follow the same pattern with their own tokens. AWS warns against an extra leading underscore: _abc123._domainkey is wrong.

BYODKIM: your own key under your own selector

Type: TXT · Host: <selector>._domainkey Copy

p=<your public key>

AWS asks for an RSA key of 1024 to 2048 bits, with the BEGIN/END lines and line breaks removed and the p= prefix kept.

Set it up and turn on signing

1. In the SES console, go to Configuration > Identities > Create identity and choose Domain.
2. Expand Advanced DKIM settings and choose Easy DKIM, Deterministic Easy DKIM or Provide DKIM authentication token (BYODKIM). For Easy DKIM, pick the DKIM signing key length and keep DKIM signatures: Enabled ticked.
3. Click Create identity. Under the identity's Authentication tab, expand Publish DNS records to copy the three CNAMEs, or download them as a .csv. If the domain is in Route 53, SES can publish them for you.
4. Create the records at your DNS host. AWS says changes can take up to 72 hours; the identity shows DKIM configuration Successful and status Verified when done.
5. To change an existing identity, open its Authentication tab and click Edit in the DomainKeys Identified Mail (DKIM) container.

DMARC alignment

Every SES message also carries a signature with d=amazonses.com, which never aligns with your From domain. Easy DKIM or BYODKIM adds a second signature with your domain, and that is the one DMARC uses. DKIM set on a domain also covers its subdomains. SPF is separate: the default MAIL FROM is a subdomain of amazonses.com, so SPF only aligns if you set a custom MAIL FROM domain.

Key length and rotation

New identities use 2048-bit keys unless you choose 1024, and you can't switch key length more than once in 24 hours (except a first downgrade to 1024). With Easy DKIM, AWS hosts the signing keys, which lets it rotate them without DNS changes; it doesn't publish a schedule. With BYODKIM you rotate your own key as often as you like. Each Region needs its own identity and records unless you use Deterministic Easy DKIM, which gives the same tokens across Regions from a parent identity. Switching an identity between Easy DKIM and BYODKIM can leave mail unsigned while the new status is pending; AWS suggests a subdomain as an intermediate step.

Common mistakes

• Your domain added twice. Many DNS hosts append the zone, turning the name into <token>._domainkey.example.com.example.com. Enter only <token>._domainkey, or end the full name with a period.
• Hardcoding dkim.amazonses.com. The signing zone differs by Region and identity; copy the target SES returns.
• Reusing one Region's records in another Region. Validation records are per Region unless you use Deterministic Easy DKIM.
• Expecting the amazonses.com signature to satisfy DMARC. It passes DKIM but never aligns with your domain.