Let’s explore how Amazon SES, SPF, and DKIM can help you improve deliverability through address authentication.
Setting up an email server is the easy part. Maintaining your organization’s reputation isn’t so simple.
Amazon designed its Simple Email Service (SES) for ease of use and maximum reliability. The product development team understands the challenges organizations face in a world rife with scammers, so they actively develop SES not only for internal Amazon use, but also for robust, versatile, and scalable service. By offloading complex infrastructure and administration tasks to Amazon, you’ll save yourself time, money, and the major headaches that go along with complicated SMTP implementations. Let’s take a deep dive into Amazon SES to see how it can help you to develop a maintainable and scalable email program.
How to Authenticate Sender Information with SPF or DKIM
Amazon SES uses the SMTP protocol which doesn’t offer a built-in authentication mechanism. How should an administrator verify beyond any doubt that he or she is properly authorized for access? How do you authenticate with ISPs and Amazon SES that you are the original sender and not an evil spammer who spoofed someone else’s account? If you want your emails delivered to live inboxes, you must authenticate yourself and your domain. You can reliably achieve this by taking advantage of one of the following two authentication mechanisms that ISPs recognize:
- Sender Policy Framework (SPF)
- DomainKeys Identified Mail (DKIM)
We will discuss these authentication mechanisms and how to best use these standards in Amazon SES.
Sender Policy Framework (SPF) for Email Spoofing Detection
In its simplest form, a Sender Policy Framework (SPF) is a simple email validation system designed to detect email spoofing by providing a mechanism that allows receiving mail exchangers to check that incoming mail. They check that a domain comes from a host who is authorized by that domain’s administrators. The list of authorized sending hosts for a domain is published in the Domain Name System (DNS) records for that domain in a specially-formatted TXT record. Email spam and phishing techniques often use forged “from” addresses, so publishing and checking SPF records can be considered an anti-spam safeguard.
Amazon SES sends the subscriber’s emails from a “Mail-From” domain that Amazon SES owns. Because Amazon owns the domain, senders don’t need to modify their DNS records for their emails to pass SPF authentication.
However, the “Mail From” domain of email sent through Amazon SES is amazonses.com (or a subdomain of that), which is different from the subscribers sending domain. The reason for this structure is inherent in SPF. Sender Policy Frameworks function by authenticating the IP address that originated from the SMTP connection to the domain used in the SMTP MAIL-FROM and/or the HELO/EHLO command. The “From” header, which is part of the email message itself, is not covered by SPF validation. Moreover, as the MAIL-FROM domain is an SES domain, which doesn’t match your sending domain, SPF authentication is misaligned for DMARC purposes.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a standard way of telling ISPs how to handle unauthenticated emails. I encourage you to click the link above and learn a little more about DMARC because it is a powerful security component that will contribute to your growing understanding of how all this complex stuff works together.
Back to the topic at hand. Users must enable Domain Keys Identified Mail signing for their verified domain in order to successfully configure DMARC.
DomainKeys Identified Mail (DKIM)
According to Wikipedia: “DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect email spoofing by providing a mechanism that allows receiving mail exchangers to check that any incoming mail from a domain is authorized by that domain’s administrators.”
In technical terms, DKIM is a technique to authorize a domain to associate its name with an email message through cryptographic authentication. Verification is carried out using the signer’s public key published in the DNS. A valid signature guarantees that some parts of the email (possibly including attachments) have not been modified since the signature was affixed.
Usually, DKIM signatures are not visible to end-users. They are affixed or verified by the infrastructure rather than the message’s authors or recipients. In that respect, DKIM differs from end-to-end digital signatures.” Again, learning more about DomainKeys Identified Mail means building your knowledge base and conceiving a greater understanding of the critical components of eMail security. Click the link and read for a few minutes. You’ll retain some of what you read and when you encounter DKIM and SPF you’ll remember some of the differences and can easily refresh your memory with a quick Google search.
How to Authenticate Email with DKIM in Amazon SES
Amazon SES provides two options to sign your messages using a DKIM signature:
- One method allows domain configuration so that Amazon SES automatically adds a DKIM signature to every message sent from specified domains.
- Another option applies your own DKIM signature to any email that you send using the SendRawEmail API. (SendRawEmail is an Amazon service that sends an email message with header and content specified by the client).
As an IT professional, you’ll want to evaluate each situation and resist the natural urge of selecting the easiest option. People won’t notice the first five or six hundred times you do it, but eventually, people will see the pattern.
Easy DKIM for SES
Amazon SES offers DKIM signing capabilities through Easy DKIM. This Amazon SES feature authenticates the integrity of an email message, including its content and headers, and proves to the ISPs that your domain is the authentic owner of the specific emails that you sent. It ensures that you take complete responsibility for the volume and contents of all emails.
Important Points Regarding Easy DKIM:
- You only need to set up Easy DKIM for the domain you use in your “From” address, not for the domain in a “Return-Path” or “Reply-To” address.
- Amazon SES has endpoints in multiple AWS regions, and Easy DKIM setup applies to each AWS region separately, you must perform the Easy DKIM setup procedure for each region in which you want to use Easy DKIM.
- If you set up Easy DKIM for a domain, it will apply to all email addresses in that domain except for email addresses that you individually verified.
- Individually verified email addresses use separate settings.
- You should be able to edit the DNS Settings.
- To prevent DNS providers from appending a DNS name if it is already present in your DNS record (e.g. _amazonses.cloudfactory.com), add a period to the end of the domain name in the DNS record. This will indicate to your DNS provider that the record name is fully qualified. Otherwise, it will end up being a duplication (e.g. _amazonses.cloudfactory.com.cloudfactory.com) and rendered invalid.
Amazon SES is a great solution for developers who need industrial-grade reliability, but you’ll want to make sure you implement the proper authentication mechanisms for ensuring delivery reliability. To learn more about SES and other critical AWS products, sign up with Cloud Academy today for a free 7-day trial subscription to our Professional PLUS plan. Here’s what you’ll get:
- Video courses led by expert instructors who have acquired every single AWS certification available.
- Self-test quizzes that help you determine which subjects on which you need to focus.
- Hands-on labs that put you in a live AWS environment to help you learn by doing.
Google Cloud Platform Certification: Preparation and Prerequisites
Google Cloud Platform (GCP) has evolved from being a niche player to a serious competitor to Amazon Web Services and Microsoft Azure. In 2019, research firm Gartner placed Google in the Leaders quadrant in its Magic Quadrant for Cloud Infrastructure as a Service for the second consecuti...
New Lab Challenges: Push Your Skills to the Next Level
Build hands-on experience using real accounts on AWS, Azure, Google Cloud Platform, and more Meaningful cloud skills require more than book knowledge. Hands-on experience is required to translate knowledge into real-world results. We see this time and time again in studies about how pe...
New on Cloud Academy: AWS Solution Architect Lab Challenge, Azure Hands-on Labs, Foundation Certificate in Cyber Security, and Much More
Now that Thanksgiving is over and the craziness of Black Friday has died down, it's now time for the busiest season of the year. Whether you're a last-minute shopper or you already have your shopping done, the holidays bring so much more excitement than any other time of year. Since our...
Understanding Enterprise Cloud Migration
What is enterprise cloud migration? Cloud migration is about moving your data, applications, and even infrastructure from your on-premises computers or infrastructure to a virtual pool of on-demand, shared resources that offer compute, storage, and network services at scale. Why d...
6 Reasons Why You Should Get an AWS Certification This Year
In the past decade, the rise of cloud computing has been undeniable. Businesses of all sizes are moving their infrastructure and applications to the cloud. This is partly because the cloud allows businesses and their employees to access important information from just about anywhere. ...
AWS Regions and Availability Zones: The Simplest Explanation You Will Ever Find Around
The basics of AWS Regions and Availability Zones We’re going to treat this article as a sort of AWS 101 — it’ll be a quick primer on AWS Regions and Availability Zones that will be useful for understanding the basics of how AWS infrastructure is organized. We’ll define each section,...
Application Load Balancer vs. Classic Load Balancer
What is an Elastic Load Balancer? This post covers basics of what an Elastic Load Balancer is, and two of its examples: Application Load Balancers and Classic Load Balancers. For additional information — including a comparison that explains Network Load Balancers — check out our post o...
Advantages and Disadvantages of Microservices Architecture
What are microservices? Let's start our discussion by setting a foundation of what microservices are. Microservices are a way of breaking large software projects into loosely coupled modules, which communicate with each other through simple Application Programming Interfaces (APIs). ...
Kubernetes Services: AWS vs. Azure vs. Google Cloud
Kubernetes is a popular open-source container orchestration platform that allows us to deploy and manage multi-container applications at scale. Businesses are rapidly adopting this revolutionary technology to modernize their applications. Cloud service providers — such as Amazon Web Ser...
AWS Internet of Things (IoT): The 3 Services You Need to Know
The Internet of Things (IoT) embeds technology into any physical thing to enable never-before-seen levels of connectivity. IoT is revolutionizing industries and creating many new market opportunities. Cloud services play an important role in enabling deployment of IoT solutions that min...
Which Certifications Should I Get?
As we mentioned in an earlier post, the old AWS slogan, “Cloud is the new normal” is indeed a reality today. Really, cloud has been the new normal for a while now and getting credentials has become an increasingly effective way to quickly showcase your abilities to recruiters and compan...
How to Go Serverless Like a Pro
So, no servers? Yeah, I checked and there are definitely no servers. Well...the cloud service providers do need servers to host and run the code, but we don’t have to worry about it. Which operating system to use, how and when to run the instances, the scalability, and all the arch...