Let’s explore how Amazon SES, SPF, and DKIM can help you improve deliverability through address authentication.
Setting up an email server is the easy part. Maintaining your organization’s reputation isn’t so simple.
Amazon designed its Simple Email Service (SES) for ease of use and maximum reliability. The product development team understands the challenges organizations face in a world rife with scammers, so they actively develop SES not only for internal Amazon use, but also for robust, versatile, and scalable service. By offloading complex infrastructure and administration tasks to Amazon, you’ll save yourself time, money, and the major headaches that go along with complicated SMTP implementations. Let’s take a deep dive into Amazon SES to see how it can help you to develop a maintainable and scalable email program.
How to Authenticate Sender Information with SPF or DKIM
Amazon SES uses the SMTP protocol which doesn’t offer a built-in authentication mechanism. How should an administrator verify beyond any doubt that he or she is properly authorized for access? How do you authenticate with ISPs and Amazon SES that you are the original sender and not an evil spammer who spoofed someone else’s account? If you want your emails delivered to live inboxes, you must authenticate yourself and your domain. You can reliably achieve this by taking advantage of one of the following two authentication mechanisms that ISPs recognize:
- Sender Policy Framework (SPF)
- DomainKeys Identified Mail (DKIM)
We will discuss these authentication mechanisms and how to best use these standards in Amazon SES.
Sender Policy Framework (SPF) for Email Spoofing Detection
In its simplest form, a Sender Policy Framework (SPF) is a simple email validation system designed to detect email spoofing by providing a mechanism that allows receiving mail exchangers to check that incoming mail. They check that a domain comes from a host who is authorized by that domain’s administrators. The list of authorized sending hosts for a domain is published in the Domain Name System (DNS) records for that domain in a specially-formatted TXT record. Email spam and phishing techniques often use forged “from” addresses, so publishing and checking SPF records can be considered an anti-spam safeguard.
Amazon SES sends the subscriber’s emails from a “Mail-From” domain that Amazon SES owns. Because Amazon owns the domain, senders don’t need to modify their DNS records for their emails to pass SPF authentication.
However, the “Mail From” domain of email sent through Amazon SES is amazonses.com (or a subdomain of that), which is different from the subscribers sending domain. The reason for this structure is inherent in SPF. Sender Policy Frameworks function by authenticating the IP address that originated from the SMTP connection to the domain used in the SMTP MAIL-FROM and/or the HELO/EHLO command. The “From” header, which is part of the email message itself, is not covered by SPF validation. Moreover, as the MAIL-FROM domain is an SES domain, which doesn’t match your sending domain, SPF authentication is misaligned for DMARC purposes.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a standard way of telling ISPs how to handle unauthenticated emails. I encourage you to click the link above and learn a little more about DMARC because it is a powerful security component that will contribute to your growing understanding of how all this complex stuff works together.
Back to the topic at hand. Users must enable Domain Keys Identified Mail signing for their verified domain in order to successfully configure DMARC.
DomainKeys Identified Mail (DKIM)
According to Wikipedia: “DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect email spoofing by providing a mechanism that allows receiving mail exchangers to check that any incoming mail from a domain is authorized by that domain’s administrators.”
In technical terms, DKIM is a technique to authorize a domain to associate its name with an email message through cryptographic authentication. Verification is carried out using the signer’s public key published in the DNS. A valid signature guarantees that some parts of the email (possibly including attachments) have not been modified since the signature was affixed.
Usually, DKIM signatures are not visible to end-users. They are affixed or verified by the infrastructure rather than the message’s authors or recipients. In that respect, DKIM differs from end-to-end digital signatures.” Again, learning more about DomainKeys Identified Mail means building your knowledge base and conceiving a greater understanding of the critical components of eMail security. Click the link and read for a few minutes. You’ll retain some of what you read and when you encounter DKIM and SPF you’ll remember some of the differences and can easily refresh your memory with a quick Google search.
How to Authenticate Email with DKIM in Amazon SES
Amazon SES provides two options to sign your messages using a DKIM signature:
- One method allows domain configuration so that Amazon SES automatically adds a DKIM signature to every message sent from specified domains.
- Another option applies your own DKIM signature to any email that you send using the SendRawEmail API. (SendRawEmail is an Amazon service that sends an email message with header and content specified by the client).
As an IT professional, you’ll want to evaluate each situation and resist the natural urge of selecting the easiest option. People won’t notice the first five or six hundred times you do it, but eventually, people will see the pattern.
Easy DKIM for SES
Amazon SES offers DKIM signing capabilities through Easy DKIM. This Amazon SES feature authenticates the integrity of an email message, including its content and headers, and proves to the ISPs that your domain is the authentic owner of the specific emails that you sent. It ensures that you take complete responsibility for the volume and contents of all emails.
Important Points Regarding Easy DKIM:
- You only need to set up Easy DKIM for the domain you use in your “From” address, not for the domain in a “Return-Path” or “Reply-To” address.
- Amazon SES has endpoints in multiple AWS regions, and Easy DKIM setup applies to each AWS region separately, you must perform the Easy DKIM setup procedure for each region in which you want to use Easy DKIM.
- If you set up Easy DKIM for a domain, it will apply to all email addresses in that domain except for email addresses that you individually verified.
- Individually verified email addresses use separate settings.
- You should be able to edit the DNS Settings.
- To prevent DNS providers from appending a DNS name if it is already present in your DNS record (e.g. _amazonses.cloudfactory.com), add a period to the end of the domain name in the DNS record. This will indicate to your DNS provider that the record name is fully qualified. Otherwise, it will end up being a duplication (e.g. _amazonses.cloudfactory.com.cloudfactory.com) and rendered invalid.
Amazon SES is a great solution for developers who need industrial-grade reliability, but you’ll want to make sure you implement the proper authentication mechanisms for ensuring delivery reliability. To learn more about SES and other critical AWS products, sign up with Cloud Academy today for a free 7-day trial subscription to our Professional PLUS plan. Here’s what you’ll get:
- Video courses led by expert instructors who have acquired every single AWS certification available.
- Self-test quizzes that help you determine which subjects on which you need to focus.
- Hands-on labs that put you in a live AWS environment to help you learn by doing.
New Content: AWS Terraform, Java Programming Lab Challenges, Azure DP-900 & DP-300 Certification Exam Prep, Plus Plenty More Amazon, Google, Microsoft, and Big Data Courses
This month our Content Team continues building the catalog of courses for everyone learning about AWS, GCP, and Microsoft Azure. In addition, this month’s updates include several Java programming lab challenges and a couple of courses on big data. In total, we released five new learning...
Where Should You Be Focusing Your AWS Security Efforts?
Another day, another re:Invent session! This time I listened to Stephen Schmidt’s session, “AWS Security: Where we've been, where we're going.” Amongst covering the highlights of AWS security during 2020, a number of newly added AWS features/services were discussed, including: AWS Audit...
AWS re:Invent: 2020 Keynote Top Highlights and More
We’ve gotten through the first five days of the special all-virtual 2020 edition of AWS re:Invent. It’s always a really exciting time for practitioners in the field to see what features and services AWS has cooked up for the year ahead. This year’s conference is a marathon and not a...
WARNING: Great Cloud Content Ahead
At Cloud Academy, content is at the heart of what we do. We work with the world’s leading cloud and operations teams to develop video courses and learning paths that accelerate teams and drive digital transformation. First and foremost, we listen to our customers’ needs and we stay ahea...
Excelling in AWS, Azure, and Beyond – How Danut Prisacaru Prepares for the Future
Meet Danut Prisacaru. Danut has been a Software Architect for the past 10 years and has been involved in Software Engineering for 30 years. He’s passionate about software and learning, and jokes that coding is basically the only thing he can do well (!). We think his enthusiasm shines t...
New Content: AWS Data Analytics – Specialty Certification, Azure AI-900 Certification, Plus New Learning Paths, Courses, Labs, and More
This month our Content Team released two big certification Learning Paths: the AWS Certified Data Analytics - Speciality, and the Azure AI Fundamentals AI-900. In total, we released four new Learning Paths, 16 courses, 24 assessments, and 11 labs. New content on Cloud Academy At any ...
New Content: Azure DP-100 Certification, Alibaba Cloud Certified Associate Prep, 13 Security Labs, and Much More
This past month our Content Team served up a heaping spoonful of new and updated content. Not only did our experts release the brand new Azure DP-100 Certification Learning Path, but they also created 18 new hands-on labs — and so much more! New content on Cloud Academy At any time, y...
AWS Certification Practice Exam: What to Expect from Test Questions
If you’re building applications on the AWS cloud or looking to get started in cloud computing, certification is a way to build deep knowledge in key services unique to the AWS platform. AWS currently offers 12 certifications that cover major cloud roles including Solutions Architect, De...
Overcoming Unprecedented Business Challenges with AWS
From auto-scaling applications with high availability to video conferencing that’s used by everyone, every day — cloud technology has never been more popular or in-demand. But what does this mean for experienced cloud professionals and the challenges they face as they carve out a new p...
Constant Content: Cloud Academy’s Q3 2020 Roadmap
Hello — Andy Larkin here, VP of Content at Cloud Academy. I am pleased to release our roadmap for the next three months of 2020 — August through October. Let me walk you through the content we have planned for you and how this content can help you gain skills, get certified, and...
New Content: Alibaba, Azure AZ-303 and AZ-304, Site Reliability Engineering (SRE) Foundation, Python 3 Programming, 16 Hands-on Labs, and Much More
This month our Content Team did an amazing job at publishing and updating a ton of new content. Not only did our experts release the brand new AZ-303 and AZ-304 Certification Learning Paths, but they also created 16 new hands-on labs — and so much more! New content on Cloud Academy At...
Blog Digest: Which Certifications Should I Get?, The 12 Microsoft Azure Certifications, 6 Ways to Prevent a Data Breach, and More
This month, we were excited to announce that Cloud Academy was recognized in the G2 Summer 2020 reports! These reports highlight the top-rated solutions in the industry, as chosen by the source that matters most: customers. We're grateful to have been nominated as a High Performer in se...