DNS records

The console’s Setup page lists the exact records for your domain, and /health checks each one. This page shows the same records for example.com in us-east-2, so you know what to expect. Your DKIM tokens, CloudFront targets and validation names are different: copy them from the console.

Add the records

Name	Type	Value	Purpose	Needed
`4fq2lxt3hdvmyw5kppxjj6zq4v2nsdyc._domainkey.example.com`	CNAME	`4fq2lxt3hdvmyw5kppxjj6zq4v2nsdyc.dkim.amazonses.com`	Easy DKIM	Yes
`wz7hrd5y3ofqnmvx2hb6kq4cjdl7sg2e._domainkey.example.com`	CNAME	`wz7hrd5y3ofqnmvx2hb6kq4cjdl7sg2e.dkim.amazonses.com`	Easy DKIM	Yes
`p3kd8tbyq2ejxm6rwn4hs7fvzl5gc9ua._domainkey.example.com`	CNAME	`p3kd8tbyq2ejxm6rwn4hs7fvzl5gc9ua.dkim.amazonses.com`	Easy DKIM	Yes
`bounce.example.com`	MX	`10 feedback-smtp.us-east-2.amazonses.com`	Custom MAIL FROM, so SPF aligns	Yes
`bounce.example.com`	TXT	`v=spf1 include:amazonses.com ~all`	SPF for the MAIL FROM domain	Yes
`_dmarc.example.com`	TXT	`v=DMARC1; p=none; rua=mailto:dmarc@example.com`	DMARC, with aggregate reports to a mailbox on your domain (an existing record is checked, never replaced)	Yes
`track.example.com`	CNAME	`d1a2b3c4d5e6f7.cloudfront.net`	HTTPS open and click tracking on your domain	Yes
`api.example.com`	CNAME	`d7f6e5d4c3b2a1.cloudfront.net`	API and unsubscribe links on your domain	Only with a custom API domain
`_1f2e3d4c5b6a7980.track.example.com`	CNAME	`_a1b2c3d4e5f60718.xlfgrmvvlj.acm-validations.aws`	Certificate validation	Yes
`_0918a7b6c5d4e3f2.api.example.com`	CNAME	`_f6e5d4c3b2a10987.xlfgrmvvlj.acm-validations.aws`	Certificate validation	Yes

DKIM: three CNAMEs for Easy DKIM. SES signs every email with your domain.
MAIL FROM: the MX and SPF records on bounce.<your domain> make the envelope sender your own subdomain, so SPF aligns with your From address.
DMARC: if your domain already has a DMARC record, we check it and never replace it. If it doesn’t, start with the record shown, v=DMARC1; p=none; rua=mailto:dmarc@<your domain>. It asks mail providers to send aggregate reports to dmarc@ your domain, so set that address up, or change it to one you read. Tighten the policy once you’re sure all your mail is authenticated.
Tracking: track.<your domain> points at our CloudFront, so open and click tracking use HTTPS on your own domain.
Custom API domain: only if you set one. See Custom domains.
Certificate validation: one CNAME for each certificate we hold for your track. and api. names.

We also recommend verifying your domain in Google Postmaster Tools, with the TXT record Google gives you, to watch your Gmail spam rate. We don’t check that record.

Check it worked: each record’s check on the Setup page turns green, usually within an hour.

Look the records up yourself

dig +short CNAME 4fq2lxt3hdvmyw5kppxjj6zq4v2nsdyc._domainkey.example.com
dig +short MX bounce.example.com
dig +short TXT bounce.example.com
dig +short TXT _dmarc.example.com
dig +short CNAME track.example.com

Replace example.com and the DKIM token with yours.

The setup checks

GET /health returns every check with a fix for each one that fails. The checks marked here block POST /campaigns/{id}/schedule until they pass.

Check	Passes when	Fix when it fails (for example.com)	Blocks scheduling
`connection`	We can assume your access role and read your stack.	Install the template in your account, then click Verify.	Yes
`template_version`	Your stack runs a template version we support. `template_outdated` means a newer one is available.	Install the template in your account.	No
`ses_production`	SES production access in your Region, so you can send to anyone.	In the SES console for us-east-2, request production access with the text on the Setup page.	Yes
`ses_sending_enabled`	SES sending isn't paused for your account.	Check the SES account dashboard and AWS Support messages for why sending is paused.	Yes
`ses_enforcement`	SES hasn't put your account on probation or shut down sending.	Review your SES reputation dashboard; campaigns keep pausing until bounce and complaint rates fall.	No
`quota`	Your SES daily quota covers your subscribed contacts (at least 10,000).	Ask AWS for a daily quota of at least 10,000.	No
`send_rate`	Your SES sending rate is at least 1 email a second.	Ask AWS for a higher sending rate.	No
`dkim`	Easy DKIM passes for your sending domain.	Add the three DKIM CNAME records for example.com shown on the Setup page.	Yes
`mail_from`	The custom MAIL FROM domain `bounce.<domain>` passes, so SPF aligns.	Add the MX and SPF TXT records for bounce.example.com.	Yes
`dmarc`	Your domain has a DMARC record with a policy.	Add a TXT record at _dmarc.example.com: v=DMARC1; p=none; rua=mailto:dmarc@example.com	Yes
`tracking_domain`	Your HTTPS tracking domain is live.	Add the CNAME for track.example.com and its certificate validation record.	No
`api_domain`	Your custom API domain is live, if you set one.	Add the CNAME for api.example.com and its certificate validation record.	No
`entitlement`	Your subscription is active or in its grace period.	Renew your subscription on AWS Marketplace.	No

curl "$BASE/health" -H "Authorization: Bearer $KEY"

Check it worked: ok is true and every check shows "ok": true.

The bulk-sender rules these records meet

Gmail, Yahoo and Microsoft require the following of bulk senders. Every campaign meets them by default, and scheduling refuses while a required record is missing.

Requirement	How it’s met
SPF and DKIM aligned with the From address	Easy DKIM and the custom MAIL FROM domain, checked when you schedule
DMARC at `p=none` or stronger	Checked when you schedule
One-click unsubscribe (RFC 8058)	`List-Unsubscribe` and `List-Unsubscribe-Post` on every email, covered by the DKIM signature
Unsubscribes honoured within 2 days	Immediately
Spam rate under 0.3% (aim for under 0.1%)	Campaigns pause at 0.1% complaints; Postmaster Tools; SES reputation alarms
Reverse DNS and TLS	Provided by SES

Read Google’s email sender guidelines for the details.