# SPF record for Amazon SES

URL: https://iblockspam.com/spf/amazon-ses
Last updated: 2026-10-09

Include: include:amazonses.com
Where it goes: Custom MAIL FROM subdomain
DNS lookups: 1 of 10

By default Amazon SES sends with a MAIL FROM address on a subdomain of amazonses.com, so SPF passes without any change to your domain. To make SPF align for DMARC, set up a custom MAIL FROM subdomain and publish v=spf1 include:amazonses.com ~all on that subdomain, plus one MX record. Your main domain's record doesn't change.

## Example records

- SPF on the custom MAIL FROM subdomain (for example bounce.example.com) (TXT, host bounce): `v=spf1 include:amazonses.com ~all` Also add one MX record on the same subdomain: 10 feedback-smtp.<region>.amazonses.com, with your AWS Region.
- Your main domain on Microsoft 365 stays as it is (TXT, host @): `v=spf1 include:spf.protection.outlook.com -all`
- Your main domain on Google Workspace stays as it is (TXT, host @): `v=spf1 include:_spf.google.com ~all`

## Notes

- The MAIL FROM subdomain must be a subdomain of your verified identity, and it shouldn't be one you also send from or receive email at.
- If the setup fails or the MX record disappears, SES falls back to its default MAIL FROM domain (if you chose that option), so mail keeps flowing but SPF stops aligning.

## How to add it

- In the Amazon SES console, open Identities and choose your verified domain.
- Under Custom MAIL FROM domain, choose Edit, select Use a custom MAIL FROM domain and enter a subdomain such as `bounce.example.com`.
- Choose the behavior on MX failure: fall back to the default MAIL FROM domain, or reject the message.
- Publish the MX and TXT records SES shows on that subdomain. Exactly one MX record is allowed there.
- Wait for SES to confirm the setup (it can take up to 72 hours to detect the MX record), then check the subdomain with the SPF Checker below.

## DKIM and DMARC

SES says you can reach DMARC through SPF, DKIM or both. SPF aligns only with a custom MAIL FROM subdomain of your From domain. Under DMARC's default relaxed alignment, `bounce.example.com` aligns with mail from `example.com` ([RFC 9989 section 4.4](https://www.rfc-editor.org/rfc/rfc9989.html#section-4.4)). DKIM signing with your domain, which SES uses to verify a domain identity, gives a second aligned pass.

## Common mistakes

- Adding `include:amazonses.com` to your main domain's record. With the default setup SES doesn't use your main domain as the MAIL FROM, so the include spends a lookup and changes nothing.
- Publishing a second MX record on the MAIL FROM subdomain: SES needs exactly one.

**Q: Do I need to add amazonses.com to my SPF record?**
Not on your main domain. SES only needs `v=spf1 include:amazonses.com ~all` on a custom MAIL FROM subdomain, if you set one up. Without one, SES uses its own amazonses.com subdomain and SPF already passes, but it doesn't align with your domain for DMARC.

**Q: Why set up a custom MAIL FROM domain in SES?**
So SPF passes for a subdomain of your own domain and can count toward DMARC. SES also needs an MX record on that subdomain to receive bounce and complaint notifications.

**Q: Can the MAIL FROM subdomain be one I already use?**
SES says it shouldn't be. It must be a subdomain of your verified domain that you don't also send from or receive email at, and it must have exactly one MX record pointing to feedback-smtp in your AWS Region.

Sources:
- Amazon SES Developer Guide: Using a custom MAIL FROM domain: https://docs.aws.amazon.com/ses/latest/dg/mail-from.html
- RFC 9989 section 4.4: Identifier alignment explained: https://www.rfc-editor.org/rfc/rfc9989.html#section-4.4

---

Source: iBlockSpam, https://iblockspam.com/spf/amazon-ses (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt