# DKIM record for Amazon SES URL: https://iblockspam.com/dkim/amazon-ses Last updated: 2026-10-09 Record type: CNAME or TXT Selectors: , , (Easy DKIM), your own (BYODKIM) Key managed by: Provider (CNAME delegation) Amazon SES Easy DKIM gives your domain three CNAME records, each `._domainkey.example.com` pointing to `.` plus a signing zone such as `dkim.us-west-2.amazonses.com`. SES hosts the keys, 2048-bit by default. With BYODKIM you publish your own public key in one TXT record under a selector you choose. ## DNS records - Easy DKIM, record 1 of 3 (AWS's example) (CNAME, host hirjd4exampled5477y22yd23ettobi._domainkey): `hirjd4exampled5477y22yd23ettobi.dkim.us-west-2.amazonses.com` Records 2 and 3 follow the same pattern with their own tokens. AWS warns against an extra leading underscore: `_abc123._domainkey` is wrong. - BYODKIM: your own key under your own selector (TXT, host ._domainkey): `p=` AWS asks for an RSA key of 1024 to 2048 bits, with the BEGIN/END lines and line breaks removed and the `p=` prefix kept. ## Set it up and turn on signing - In the SES console, go to **Configuration > Identities > Create identity** and choose **Domain**. - Expand **Advanced DKIM settings** and choose **Easy DKIM**, **Deterministic Easy DKIM** or **Provide DKIM authentication token (BYODKIM)**. For Easy DKIM, pick the **DKIM signing key length** and keep **DKIM signatures: Enabled** ticked. - Click **Create identity**. Under the identity's **Authentication** tab, expand **Publish DNS records** to copy the three CNAMEs, or download them as a .csv. If the domain is in Route 53, SES can publish them for you. - Create the records at your DNS host. AWS says changes can take up to 72 hours; the identity shows DKIM configuration Successful and status Verified when done. - To change an existing identity, open its Authentication tab and click **Edit** in the DomainKeys Identified Mail (DKIM) container. ## DMARC alignment Every SES message also carries a signature with `d=amazonses.com`, which never aligns with your From domain. Easy DKIM or BYODKIM adds a second signature with your domain, and that is the one DMARC uses. DKIM set on a domain also covers its subdomains. SPF is separate: the default MAIL FROM is a subdomain of `amazonses.com`, so SPF only aligns if you set a custom MAIL FROM domain. ## Key length and rotation New identities use 2048-bit keys unless you choose 1024, and you can't switch key length more than once in 24 hours (except a first downgrade to 1024). With Easy DKIM, AWS hosts the signing keys, which lets it rotate them without DNS changes; it doesn't publish a schedule. With BYODKIM you rotate your own key as often as you like. Each Region needs its own identity and records unless you use Deterministic Easy DKIM, which gives the same tokens across Regions from a parent identity. Switching an identity between Easy DKIM and BYODKIM can leave mail unsigned while the new status is pending; AWS suggests a subdomain as an intermediate step. ## Common mistakes - **Your domain added twice.** Many DNS hosts append the zone, turning the name into `._domainkey.example.com.example.com`. Enter only `._domainkey`, or end the full name with a period. - **Hardcoding `dkim.amazonses.com`.** The signing zone differs by Region and identity; copy the target SES returns. - **Reusing one Region's records in another Region.** Validation records are per Region unless you use Deterministic Easy DKIM. - **Expecting the amazonses.com signature to satisfy DMARC.** It passes DKIM but never aligns with your domain. **Q: Why do my SES emails have two DKIM signatures?** SES signs every message with `d=amazonses.com`. Once Easy DKIM or BYODKIM is set up, it adds a second signature with your domain. Receivers check both, and DMARC uses the one that matches your From domain. **Q: Do I need separate SES DKIM records for each AWS Region?** Yes, with standard Easy DKIM: each Region's identity has its own tokens. Deterministic Easy DKIM generates the same tokens across Regions from a parent identity, so replicas need no extra DNS records. **Q: Can I use my own DKIM key with Amazon SES?** Yes, with BYODKIM. Generate an RSA key pair of 1024 to 2048 bits, publish the public key as a TXT record at `._domainkey`, and give SES the private key and selector. You then choose when to rotate. Sources: - Amazon SES Developer Guide: Easy DKIM in Amazon SES: https://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-dkim-easy.html - Amazon SES Developer Guide: Provide your own DKIM authentication token (BYODKIM): https://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-dkim-bring-your-own.html - Amazon SES Developer Guide: Using Deterministic Easy DKIM (DEED): https://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-dkim-deed.html - Amazon SES Developer Guide: Complying with DMARC authentication protocol: https://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-dmarc.html - Amazon SES Developer Guide: Troubleshooting DKIM problems: https://docs.aws.amazon.com/ses/latest/dg/troubleshoot-dkim.html --- Source: iBlockSpam, https://iblockspam.com/dkim/amazon-ses (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt