How to Authenticate Email Addresses with Amazon SES to Improve Deliverability

Let’s explore how Amazon SES, SPF, and DKIM can help you improve deliverability through address authentication.

Setting up an email server is the easy part. Maintaining your organization’s reputation isn’t so simple.

Amazon designed its Simple Email Service (SES) for ease of use and maximum reliability. The product development team understands the challenges organizations face in a world rife with scammers, so they actively develop SES not only for internal Amazon use, but also for robust, versatile, and scalable service. By offloading complex infrastructure and administration tasks to Amazon, you’ll save yourself time, money, and the major headaches that go along with complicated SMTP implementations. Let’s take a deep dive into Amazon SES to see how it can help you to develop a maintainable and scalable email program.

How to Authenticate Sender Information with SPF or DKIM

Amazon SES uses the SMTP protocol which doesn’t offer a built-in authentication mechanism. How should an administrator verify beyond any doubt that he or she is properly authorized for access? How do you authenticate with ISPs and Amazon SES that you are the original sender and not an evil spammer who spoofed someone else’s account? If you want your emails delivered to live inboxes, you must authenticate yourself and your domain. You can reliably achieve this by taking advantage of one of the following two authentication mechanisms that ISPs recognize:

  1. Sender Policy Framework (SPF)
  2. DomainKeys Identified Mail (DKIM)

We will discuss these authentication mechanisms and how to best use these standards in Amazon SES.

Sender Policy Framework (SPF) for Email Spoofing Detection

In its simplest form, a Sender Policy Framework (SPF) is a simple email validation system designed to detect email spoofing by providing a mechanism that allows receiving mail exchangers to check that incoming mail. They check that a domain comes from a host who is authorized by that domain’s administrators. The list of authorized sending hosts for a domain is published in the Domain Name System (DNS) records for that domain in a specially-formatted TXT record. Email spam and phishing techniques often use forged “from” addresses, so publishing and checking SPF records can be considered an anti-spam safeguard.

Amazon SES sends the subscriber’s emails from a “Mail-From” domain that Amazon SES owns. Because Amazon owns the domain, senders don’t need to modify their DNS records for their emails to pass SPF authentication.

However, the “Mail From” domain of email sent through Amazon SES is (or a subdomain of that), which is different from the subscribers sending domain.  The reason for this structure is inherent in SPF.  Sender Policy Frameworks function by authenticating the IP address that originated from the SMTP connection to the domain used in the SMTP MAIL-FROM and/or the HELO/EHLO command. The “From” header, which is part of the email message itself, is not covered by SPF validation. Moreover, as the MAIL-FROM domain is an SES domain, which doesn’t match your sending domain, SPF authentication is misaligned for DMARC purposes.

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a standard way of telling ISPs how to handle unauthenticated emails. I encourage you to click the link above and learn a little more about DMARC because it is a powerful security component that will contribute to your growing understanding of how all this complex stuff works together.
Back to the topic at hand. Users must enable Domain Keys Identified Mail signing for their verified domain in order to successfully configure DMARC.

DomainKeys Identified Mail (DKIM)

According to Wikipedia: “DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect email spoofing by providing a mechanism that allows receiving mail exchangers to check that any incoming mail from a domain is authorized by that domain’s administrators.”

In technical terms, DKIM is a technique to authorize a domain to associate its name with an email message through cryptographic authentication. Verification is carried out using the signer’s public key published in the DNS. A valid signature guarantees that some parts of the email (possibly including attachments) have not been modified since the signature was affixed.
Usually, DKIM signatures are not visible to end-users. They are affixed or verified by the infrastructure rather than the message’s authors or recipients. In that respect, DKIM differs from end-to-end digital signatures.” Again, learning more about DomainKeys Identified Mail means building your knowledge base and conceiving a greater understanding of the critical components of eMail security. Click the link and read for a few minutes. You’ll retain some of what you read and when you encounter DKIM and SPF you’ll remember some of the differences and can easily refresh your memory with a quick Google search.

How to Authenticate Email with DKIM in Amazon SES

Amazon SES provides two options to sign your messages using a DKIM signature:

  • One method allows domain configuration so that Amazon SES automatically adds a DKIM signature to every message sent from specified domains.
  • Another option applies your own DKIM signature to any email that you send using the SendRawEmail API. (SendRawEmail is an Amazon service that sends an email message with header and content specified by the client).

As an IT professional, you’ll want to evaluate each situation and resist the natural urge of selecting the easiest option. People won’t notice the first five or six hundred times you do it, but eventually, people will see the pattern.
Easy DKIM for SES
Amazon SES offers DKIM signing capabilities through Easy DKIM. This Amazon SES feature authenticates the integrity of an email message, including its content and headers, and proves to the ISPs that your domain is the authentic owner of the specific emails that you sent. It ensures that you take complete responsibility for the volume and contents of all emails.

Important Points Regarding Easy DKIM:

  • You only need to set up Easy DKIM for the domain you use in your “From” address, not for the domain in a “Return-Path” or “Reply-To” address.
  • Amazon SES has endpoints in multiple AWS regions, and Easy DKIM setup applies to each AWS region separately, you must perform the Easy DKIM setup procedure for each region in which you want to use Easy DKIM.
  • If you set up Easy DKIM for a domain, it will apply to all email addresses in that domain except for email addresses that you individually verified.
    • Individually verified email addresses use separate settings.
  • You should be able to edit the DNS Settings.
  • To prevent DNS providers from appending a DNS name if it is already present in your DNS record (e.g., add a period to the end of the domain name in the DNS record. This will indicate to your DNS provider that the record name is fully qualified. Otherwise, it will end up being a duplication (e.g. and rendered invalid.


Amazon SES is a great solution for developers who need industrial-grade reliability, but you’ll want to make sure you implement the proper authentication mechanisms for ensuring delivery reliability. To learn more about SES and other critical AWS products, sign up with Cloud Academy today for a free 7-day trial subscription to our Professional PLUS plan. Here’s what you’ll get:

  • Video courses led by expert instructors who have acquired every single AWS certification available.
  • Self-test quizzes that help you determine which subjects on which you need to focus.
  • Hands-on labs that put you in a live AWS environment to help you learn by doing. 

Sign Up Now for Your Free 7-Day Trial – Comprehensive AWS Prep


Written by

Chandan Patra

Cloud Computing and Big Data professional with 10 years of experience in pre-sales, architecture, design, build and troubleshooting with best engineering practices.Specialities: Cloud Computing - AWS, DevOps(Chef), Hadoop Ecosystem, Storm & Kafka, ELK Stack, NoSQL, Java, Spring, Hibernate, Web Service

Related Posts

— February 11, 2019

WaitCondition Controls the Pace of AWS CloudFormation Templates

AWS's WaitCondition can be used with CloudFormation templates to ensure required resources are running.As you may already be aware, AWS CloudFormation is used for infrastructure automation by allowing you to write JSON templates to automatically install, configure, and bootstrap your ...

Read more
  • AWS
— January 24, 2019

The 9 AWS Certifications: Which is Right for You and Your Team?

As companies increasingly shift workloads to the public cloud, cloud computing has moved from a nice-to-have to a core competency in the enterprise. This shift requires a new set of skills to design, deploy, and manage applications in the cloud.As the market leader and most mature p...

Read more
  • AWS
  • AWS certifications
— November 28, 2018

Two New EC2 Instance Types Announced at AWS re:Invent 2018 – Monday Night Live

The announcements at re:Invent just keep on coming! Let’s look at what benefits these two new EC2 instance types offer and how these two new instances could be of benefit to you. If you're not too familiar with Amazon EC2, you might want to familiarize yourself by creating your first Am...

Read more
  • AWS
  • EC2
  • re:Invent 2018
— November 21, 2018

Google Cloud Certification: Preparation and Prerequisites

Google Cloud Platform (GCP) has evolved from being a niche player to a serious competitor to Amazon Web Services and Microsoft Azure. In 2018, research firm Gartner placed Google in the Leaders quadrant in its Magic Quadrant for Cloud Infrastructure as a Service for the first time. In t...

Read more
  • AWS
  • Azure
  • Google Cloud
Khash Nakhostin
— November 13, 2018

Understanding AWS VPC Egress Filtering Methods

In order to understand AWS VPC egress filtering methods, you first need to understand that security on AWS is governed by a shared responsibility model where both vendor and subscriber have various operational responsibilities. AWS assumes responsibility for the underlying infrastructur...

Read more
  • Aviatrix
  • AWS
  • VPC
— November 10, 2018

S3 FTP: Build a Reliable and Inexpensive FTP Server Using Amazon’s S3

Is it possible to create an S3 FTP file backup/transfer solution, minimizing associated file storage and capacity planning administration headache?FTP (File Transfer Protocol) is a fast and convenient way to transfer large files over the Internet. You might, at some point, have conf...

Read more
  • Amazon S3
  • AWS
— October 18, 2018

Microservices Architecture: Advantages and Drawbacks

Microservices are a way of breaking large software projects into loosely coupled modules, which communicate with each other through simple Application Programming Interfaces (APIs).Microservices have become increasingly popular over the past few years. The modular architectural style,...

Read more
  • AWS
  • Microservices
— October 2, 2018

What Are Best Practices for Tagging AWS Resources?

There are many use cases for tags, but what are the best practices for tagging AWS resources? In order for your organization to effectively manage resources (and your monthly AWS bill), you need to implement and adopt a thoughtful tagging strategy that makes sense for your business. The...

Read more
  • AWS
  • cost optimization
— September 26, 2018

How to Optimize Amazon S3 Performance

Amazon S3 is the most common storage options for many organizations, being object storage it is used for a wide variety of data types, from the smallest objects to huge datasets. All in all, Amazon S3 is a great service to store a wide scope of data types in a highly available and resil...

Read more
  • Amazon S3
  • AWS
— September 18, 2018

How to Optimize Cloud Costs with Spot Instances: New on Cloud Academy

One of the main promises of cloud computing is access to nearly endless capacity. However, it doesn’t come cheap. With the introduction of Spot Instances for Amazon Web Services’ Elastic Compute Cloud (AWS EC2) in 2009, spot instances have been a way for major cloud providers to sell sp...

Read more
  • AWS
  • Azure
  • Google Cloud
  • SpotInst
— August 23, 2018

What are the Benefits of Machine Learning in the Cloud?

A Comparison of Machine Learning Services on AWS, Azure, and Google CloudArtificial intelligence and machine learning are steadily making their way into enterprise applications in areas such as customer support, fraud detection, and business intelligence. There is every reason to beli...

Read more
  • AWS
  • Azure
  • Google Cloud
  • Machine Learning
— August 17, 2018

How to Use AWS CLI

The AWS Command Line Interface (CLI) is for managing your AWS services from a terminal session on your own client, allowing you to control and configure multiple AWS services.So you’ve been using AWS for awhile and finally feel comfortable clicking your way through all the services....

Read more
  • AWS