Let’s explore how Amazon SES, SPF, and DKIM can help you improve deliverability through address authentication.
Setting up an email server is the easy part. Maintaining your organization’s reputation isn’t so simple.
Amazon designed its Simple Email Service (SES) for ease of use and maximum reliability. The product development team understands the challenges organizations face in a world rife with scammers, so they actively develop SES not only for internal Amazon use, but also for robust, versatile, and scalable service. By offloading complex infrastructure and administration tasks to Amazon, you’ll save yourself time, money, and the major headaches that go along with complicated SMTP implementations. Let’s take a deep dive into Amazon SES to see how it can help you to develop a maintainable and scalable email program.
How to Authenticate Sender Information with SPF or DKIM
Amazon SES uses the SMTP protocol which doesn’t offer a built-in authentication mechanism. How should an administrator verify beyond any doubt that he or she is properly authorized for access? How do you authenticate with ISPs and Amazon SES that you are the original sender and not an evil spammer who spoofed someone else’s account? If you want your emails delivered to live inboxes, you must authenticate yourself and your domain. You can reliably achieve this by taking advantage of one of the following two authentication mechanisms that ISPs recognize:
- Sender Policy Framework (SPF)
- DomainKeys Identified Mail (DKIM)
We will discuss these authentication mechanisms and how to best use these standards in Amazon SES.
Sender Policy Framework (SPF) for Email Spoofing Detection
In its simplest form, a Sender Policy Framework (SPF) is a simple email validation system designed to detect email spoofing by providing a mechanism that allows receiving mail exchangers to check that incoming mail. They check that a domain comes from a host who is authorized by that domain’s administrators. The list of authorized sending hosts for a domain is published in the Domain Name System (DNS) records for that domain in a specially-formatted TXT record. Email spam and phishing techniques often use forged “from” addresses, so publishing and checking SPF records can be considered an anti-spam safeguard.
Amazon SES sends the subscriber’s emails from a “Mail-From” domain that Amazon SES owns. Because Amazon owns the domain, senders don’t need to modify their DNS records for their emails to pass SPF authentication.
However, the “Mail From” domain of email sent through Amazon SES is amazonses.com (or a subdomain of that), which is different from the subscribers sending domain. The reason for this structure is inherent in SPF. Sender Policy Frameworks function by authenticating the IP address that originated from the SMTP connection to the domain used in the SMTP MAIL-FROM and/or the HELO/EHLO command. The “From” header, which is part of the email message itself, is not covered by SPF validation. Moreover, as the MAIL-FROM domain is an SES domain, which doesn’t match your sending domain, SPF authentication is misaligned for DMARC purposes.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a standard way of telling ISPs how to handle unauthenticated emails. I encourage you to click the link above and learn a little more about DMARC because it is a powerful security component that will contribute to your growing understanding of how all this complex stuff works together.
Back to the topic at hand. Users must enable Domain Keys Identified Mail signing for their verified domain in order to successfully configure DMARC.
DomainKeys Identified Mail (DKIM)
According to Wikipedia: “DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect email spoofing by providing a mechanism that allows receiving mail exchangers to check that any incoming mail from a domain is authorized by that domain’s administrators.”
In technical terms, DKIM is a technique to authorize a domain to associate its name with an email message through cryptographic authentication. Verification is carried out using the signer’s public key published in the DNS. A valid signature guarantees that some parts of the email (possibly including attachments) have not been modified since the signature was affixed.
Usually, DKIM signatures are not visible to end-users. They are affixed or verified by the infrastructure rather than the message’s authors or recipients. In that respect, DKIM differs from end-to-end digital signatures.” Again, learning more about DomainKeys Identified Mail means building your knowledge base and conceiving a greater understanding of the critical components of eMail security. Click the link and read for a few minutes. You’ll retain some of what you read and when you encounter DKIM and SPF you’ll remember some of the differences and can easily refresh your memory with a quick Google search.
How to Authenticate Email with DKIM in Amazon SES
Amazon SES provides two options to sign your messages using a DKIM signature:
- One method allows domain configuration so that Amazon SES automatically adds a DKIM signature to every message sent from specified domains.
- Another option applies your own DKIM signature to any email that you send using the SendRawEmail API. (SendRawEmail is an Amazon service that sends an email message with header and content specified by the client).
As an IT professional, you’ll want to evaluate each situation and resist the natural urge of selecting the easiest option. People won’t notice the first five or six hundred times you do it, but eventually, people will see the pattern.
Easy DKIM for SES
Amazon SES offers DKIM signing capabilities through Easy DKIM. This Amazon SES feature authenticates the integrity of an email message, including its content and headers, and proves to the ISPs that your domain is the authentic owner of the specific emails that you sent. It ensures that you take complete responsibility for the volume and contents of all emails.
Important Points Regarding Easy DKIM:
- You only need to set up Easy DKIM for the domain you use in your “From” address, not for the domain in a “Return-Path” or “Reply-To” address.
- Amazon SES has endpoints in multiple AWS regions, and Easy DKIM setup applies to each AWS region separately, you must perform the Easy DKIM setup procedure for each region in which you want to use Easy DKIM.
- If you set up Easy DKIM for a domain, it will apply to all email addresses in that domain except for email addresses that you individually verified.
- Individually verified email addresses use separate settings.
- You should be able to edit the DNS Settings.
- To prevent DNS providers from appending a DNS name if it is already present in your DNS record (e.g. _amazonses.cloudfactory.com), add a period to the end of the domain name in the DNS record. This will indicate to your DNS provider that the record name is fully qualified. Otherwise, it will end up being a duplication (e.g. _amazonses.cloudfactory.com.cloudfactory.com) and rendered invalid.
Amazon SES is a great solution for developers who need industrial-grade reliability, but you’ll want to make sure you implement the proper authentication mechanisms for ensuring delivery reliability. To learn more about SES and other critical AWS products, sign up with Cloud Academy today for a free 7-day trial subscription to our Professional PLUS plan. Here’s what you’ll get:
- Video courses led by expert instructors who have acquired every single AWS certification available.
- Self-test quizzes that help you determine which subjects on which you need to focus.
- Hands-on labs that put you in a live AWS environment to help you learn by doing.
New Content: Azure DP-100 Certification, Alibaba Cloud Certified Associate Prep, 13 Security Labs, and Much More
This past month our Content Team served up a heaping spoonful of new and updated content. Not only did our experts release the brand new Azure DP-100 Certification Learning Path, but they also created 18 new hands-on labs — and so much more! New content on Cloud Academy At any time, y...
AWS Certification Practice Exam: What to Expect from Test Questions
If you’re building applications on the AWS cloud or looking to get started in cloud computing, certification is a way to build deep knowledge in key services unique to the AWS platform. AWS currently offers 12 certifications that cover major cloud roles including Solutions Architect, De...
Overcoming Unprecedented Business Challenges with AWS
From auto-scaling applications with high availability to video conferencing that’s used by everyone, every day — cloud technology has never been more popular or in-demand. But what does this mean for experienced cloud professionals and the challenges they face as they carve out a new p...
Constant Content: Cloud Academy’s Q3 2020 Roadmap
Hello — Andy Larkin here, VP of Content at Cloud Academy. I am pleased to release our roadmap for the next three months of 2020 — August through October. Let me walk you through the content we have planned for you and how this content can help you gain skills, get certified, and...
New Content: Alibaba, Azure AZ-303 and AZ-304, Site Reliability Engineering (SRE) Foundation, Python 3 Programming, 16 Hands-on Labs, and Much More
This month our Content Team did an amazing job at publishing and updating a ton of new content. Not only did our experts release the brand new AZ-303 and AZ-304 Certification Learning Paths, but they also created 16 new hands-on labs — and so much more! New content on Cloud Academy At...
Blog Digest: Which Certifications Should I Get?, The 12 Microsoft Azure Certifications, 6 Ways to Prevent a Data Breach, and More
This month, we were excited to announce that Cloud Academy was recognized in the G2 Summer 2020 reports! These reports highlight the top-rated solutions in the industry, as chosen by the source that matters most: customers. We're grateful to have been nominated as a High Performer in se...
Which Certifications Should I Get?
The old AWS slogan, “Cloud is the new normal” is indeed a reality today. Really, cloud has been the new normal for a while now and getting credentials has become an increasingly effective way to quickly showcase your abilities to recruiters and companies. With all that in mind, the s...
New Content: AWS, Azure, Typescript, Java, Docker, 13 New Labs, and Much More
This month, our Content Team released a whopping 13 new labs in real cloud environments! If you haven't tried out our labs, you might not understand why we think that number is so impressive. Our labs are not “simulated” experiences — they are real cloud environments using accounts on A...
Kickstart Your Tech Training With a Free Week on Cloud Academy
Are you looking to make a jump in your technical career? Want to get trained or certified on AWS, Azure, Google Cloud Platform, DevOps, Kubernetes, Python, or another in-demand skill? Then you'll want to mark your calendar. Starting Monday, June 22 at 12:00 a.m. PDT (3:00 a.m. EDT), ...
New Content: AZ-500 and AZ-400 Updates, 3 Google Professional Exam Preps, Practical ML Learning Path, C# Programming, and More
This month, our Content Team released tons of new content and labs in real cloud environments. Not only that, but we introduced our very first highly interactive "Office Hours" webinar. This webinar, Acing the AWS Solutions Architect Associate Certification, started with a quick overvie...
Azure vs. AWS: Which Certification Provides the Brighter Future?
More and more companies are using cloud services, prompting more and more people to switch their current IT position to something cloud-related. The problem is most people only have that much time after work to learn new technologies, and there are plenty of cloud services that you can ...
Blog Digest: 5 Reasons to Get AWS Certified, OWASP Top 10, Getting Started with VPCs, Top 10 Soft Skills, and More
Thank you for being a valued member of our community! We recently sent out a short survey to understand what type of content you would like us to add to Cloud Academy, and we want to thank everyone who gave us their input. If you would like to complete the survey, it's not too late. It ...