SPF record for Amazon SES

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

SPF on the custom MAIL FROM subdomain (for example bounce.example.com)

Type: TXT · Host: bounce · 1 of 10 DNS lookups Copy

v=spf1 include:amazonses.com ~all

Also add one MX record on the same subdomain: 10 feedback-smtp.<region>.amazonses.com, with your AWS Region.

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

Your main domain on Google Workspace stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com ~all

How SPF applies to Amazon SES mail

Amazon SES sends with a bounce (MAIL FROM) address on a subdomain set up for it, and receivers check SPF on that subdomain. Your main domain's SPF record doesn't need to change for Amazon SES.

• The MAIL FROM subdomain must be a subdomain of your verified identity, and it shouldn't be one you also send from or receive email at.
• If the setup fails or the MX record disappears, SES falls back to its default MAIL FROM domain (if you chose that option), so mail keeps flowing but SPF stops aligning.

How to add it

1. In the Amazon SES console, open Identities and choose your verified domain.
2. Under Custom MAIL FROM domain, choose Edit, select Use a custom MAIL FROM domain and enter a subdomain such as bounce.example.com.
3. Choose the behavior on MX failure: fall back to the default MAIL FROM domain, or reject the message.
4. Publish the MX and TXT records SES shows on that subdomain. Exactly one MX record is allowed there.
5. Wait for SES to confirm the setup (it can take up to 72 hours to detect the MX record), then check the subdomain with the SPF Checker below.

DKIM and DMARC alignment

SES says you can reach DMARC through SPF, DKIM or both. SPF aligns only with a custom MAIL FROM subdomain of your From domain. Under DMARC's default relaxed alignment, bounce.example.com aligns with mail from example.com (RFC 9989 section 4.4). DKIM signing with your domain, which SES uses to verify a domain identity, gives a second aligned pass.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Amazon SES's include costs 1 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Amazon SES's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding include:amazonses.com to your main domain's record. With the default setup SES doesn't use your main domain as the MAIL FROM, so the include spends a lookup and changes nothing.
• Publishing a second MX record on the MAIL FROM subdomain: SES needs exactly one.