AWS offers the tools to make sure yours don’t. Using DKIM, SPF, and DMARC, you can secure your outbound emails, protect your domain reputation, and boost deliverability. Done right, these settings tell receiving mail servers who you are, prove you own your identity, and stop attackers from impersonating you. Done wrong—or left undone—they open the door to phishing, spam, and blocked messages.
SPF: Declare Your Senders
Sender Policy Framework (SPF) works like a public list of which servers can send email for your domain. In AWS, you create a TXT record in your DNS that contains the allowed IPs or hostnames. Keep this list precise. Too broad, and you invite abuse. Too narrow, and you block your own messages. Review it often—especially if you use third-party services to send on your behalf.
DKIM: Sign Your Emails
DomainKeys Identified Mail (DKIM) attaches a cryptographic signature to every message you send. In AWS Simple Email Service (SES), enabling DKIM will give you CNAME records to add to your DNS. Once set, every outgoing message is signed with your private key, and recipients verify it using your public key. This ensures the email hasn’t been altered and proves it came from your domain.
DMARC: Enforce and Monitor
Domain-based Message Authentication, Reporting, and Conformance (DMARC) ties SPF and DKIM together. It lets you set policies for how mail servers handle unauthenticated messages. In AWS, you’ll add a TXT record in DNS specifying your DMARC policy, such as none, quarantine, or reject, and an address to send reports. Start with none to collect data. Move to quarantine or reject once you’re confident SPF and DKIM pass consistently.