Let’s explore how Amazon SES, SPF, and DKIM can help you improve deliverability through address authentication.
Setting up an email server is the easy part. Maintaining your organization’s reputation isn’t so simple.
Amazon designed its Simple Email Service (SES) for ease of use and maximum reliability. The product development team understands the challenges organizations face in a world rife with scammers, so they actively develop SES not only for internal Amazon use, but also for robust, versatile, and scalable service. By offloading complex infrastructure and administration tasks to Amazon, you’ll save yourself time, money, and the major headaches that go along with complicated SMTP implementations. Let’s take a deep dive into Amazon SES to see how it can help you to develop a maintainable and scalable email program.
How to Authenticate Sender Information with SPF or DKIM
Amazon SES uses the SMTP protocol which doesn’t offer a built-in authentication mechanism. How should an administrator verify beyond any doubt that he or she is properly authorized for access? How do you authenticate with ISPs and Amazon SES that you are the original sender and not an evil spammer who spoofed someone else’s account? If you want your emails delivered to live inboxes, you must authenticate yourself and your domain. You can reliably achieve this by taking advantage of one of the following two authentication mechanisms that ISPs recognize:
- Sender Policy Framework (SPF)
- DomainKeys Identified Mail (DKIM)
We will discuss these authentication mechanisms and how to best use these standards in Amazon SES.
Sender Policy Framework (SPF) for Email Spoofing Detection
In its simplest form, a Sender Policy Framework (SPF) is a simple email validation system designed to detect email spoofing by providing a mechanism that allows receiving mail exchangers to check that incoming mail. They check that a domain comes from a host who is authorized by that domain’s administrators. The list of authorized sending hosts for a domain is published in the Domain Name System (DNS) records for that domain in a specially-formatted TXT record. Email spam and phishing techniques often use forged “from” addresses, so publishing and checking SPF records can be considered an anti-spam safeguard.
Amazon SES sends the subscriber’s emails from a “Mail-From” domain that Amazon SES owns. Because Amazon owns the domain, senders don’t need to modify their DNS records for their emails to pass SPF authentication.
However, the “Mail From” domain of email sent through Amazon SES is amazonses.com (or a subdomain of that), which is different from the subscribers sending domain. The reason for this structure is inherent in SPF. Sender Policy Frameworks function by authenticating the IP address that originated from the SMTP connection to the domain used in the SMTP MAIL-FROM and/or the HELO/EHLO command. The “From” header, which is part of the email message itself, is not covered by SPF validation. Moreover, as the MAIL-FROM domain is an SES domain, which doesn’t match your sending domain, SPF authentication is misaligned for DMARC purposes.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a standard way of telling ISPs how to handle unauthenticated emails. I encourage you to click the link above and learn a little more about DMARC because it is a powerful security component that will contribute to your growing understanding of how all this complex stuff works together.
Back to the topic at hand. Users must enable Domain Keys Identified Mail signing for their verified domain in order to successfully configure DMARC.
DomainKeys Identified Mail (DKIM)
According to Wikipedia: “DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect email spoofing by providing a mechanism that allows receiving mail exchangers to check that any incoming mail from a domain is authorized by that domain’s administrators.”
In technical terms, DKIM is a technique to authorize a domain to associate its name with an email message through cryptographic authentication. Verification is carried out using the signer’s public key published in the DNS. A valid signature guarantees that some parts of the email (possibly including attachments) have not been modified since the signature was affixed.
Usually, DKIM signatures are not visible to end-users. They are affixed or verified by the infrastructure rather than the message’s authors or recipients. In that respect, DKIM differs from end-to-end digital signatures.” Again, learning more about DomainKeys Identified Mail means building your knowledge base and conceiving a greater understanding of the critical components of eMail security. Click the link and read for a few minutes. You’ll retain some of what you read and when you encounter DKIM and SPF you’ll remember some of the differences and can easily refresh your memory with a quick Google search.
How to Authenticate Email with DKIM in Amazon SES
Amazon SES provides two options to sign your messages using a DKIM signature:
- One method allows domain configuration so that Amazon SES automatically adds a DKIM signature to every message sent from specified domains.
- Another option applies your own DKIM signature to any email that you send using the SendRawEmail API. (SendRawEmail is an Amazon service that sends an email message with header and content specified by the client).
As an IT professional, you’ll want to evaluate each situation and resist the natural urge of selecting the easiest option. People won’t notice the first five or six hundred times you do it, but eventually, people will see the pattern.
Easy DKIM for SES
Amazon SES offers DKIM signing capabilities through Easy DKIM. This Amazon SES feature authenticates the integrity of an email message, including its content and headers, and proves to the ISPs that your domain is the authentic owner of the specific emails that you sent. It ensures that you take complete responsibility for the volume and contents of all emails.
Important Points Regarding Easy DKIM:
- You only need to set up Easy DKIM for the domain you use in your “From” address, not for the domain in a “Return-Path” or “Reply-To” address.
- Amazon SES has endpoints in multiple AWS regions, and Easy DKIM setup applies to each AWS region separately, you must perform the Easy DKIM setup procedure for each region in which you want to use Easy DKIM.
- If you set up Easy DKIM for a domain, it will apply to all email addresses in that domain except for email addresses that you individually verified.
- Individually verified email addresses use separate settings.
- You should be able to edit the DNS Settings.
- To prevent DNS providers from appending a DNS name if it is already present in your DNS record (e.g. _amazonses.cloudfactory.com), add a period to the end of the domain name in the DNS record. This will indicate to your DNS provider that the record name is fully qualified. Otherwise, it will end up being a duplication (e.g. _amazonses.cloudfactory.com.cloudfactory.com) and rendered invalid.
Amazon SES is a great solution for developers who need industrial-grade reliability, but you’ll want to make sure you implement the proper authentication mechanisms for ensuring delivery reliability. To learn more about SES and other critical AWS products, sign up with Cloud Academy today for a free 7-day trial subscription to our Professional PLUS plan. Here’s what you’ll get:
- Video courses led by expert instructors who have acquired every single AWS certification available.
- Self-test quizzes that help you determine which subjects on which you need to focus.
- Hands-on labs that put you in a live AWS environment to help you learn by doing.
Working with AWS Networking & Amazon VPC
Being able to architect your own isolated segment of AWS is a simple process using VPCs; understanding how to architect its related networking components and connectivity architecture is key to making it a powerful service.Many services within Amazon Web Services (AWS) require you t...
AWS Compute Fundamentals Update
AWS is renowned for the rate at which it reinvents, revolutionizes, and meets customer demands and expectations through its continuous cycle of feature and service updates. With hundreds of updates a month, it can be difficult to stay on top of all the changes made available. Here ...
10 Steps for an Effective Reserved Instances Strategy
Amazon Web Services (AWS) offers three different ways to pay for EC2 Instances: On-Demand, Reserved Instances, and Spot Instances. This article will focus on effective strategies for purchasing Reserved Instances. While most of the major cloud platforms offer pre-pay and reservation dis...
AWS Certification Practice Exam: What to Expect from Test Questions
If you’re building applications on the AWS cloud or looking to get started in cloud computing, certification is a way to build deep knowledge in key services unique to the AWS platform. AWS currently offers 11 certifications that cover major cloud roles including Solutions Architect, De...
AWS Certified Solutions Architect Associate: A Study Guide
The AWS Solutions Architect - Associate Certification (or Sol Arch Associate for short) offers some clear benefits: Increases marketability to employers Provides solid credentials in a growing industry (with projected growth of as much as 70 percent in five years) Market anal...
Moving Data to S3 with Apache NiFi
Moving data to the cloud is one of the cornerstones of any cloud migration. Apache NiFi is an open source tool that enables you to easily move and process data using a graphical user interface (GUI). In this blog post, we will examine a simple way to move data to the cloud using NiFi c...
Amazon DynamoDB: 10 Things You Should Know
Amazon DynamoDB is a managed NoSQL service with strong consistency and predictable performance that shields users from the complexities of manual setup.Whether or not you've actually used a NoSQL data store yourself, it's probably a good idea to make sure you fully understand the key ...
The 11 AWS Certifications: Which is Right for You and Your Team?
As companies increasingly shift workloads to the public cloud, cloud computing has moved from a nice-to-have to a core competency in the enterprise. This shift requires a new set of skills to design, deploy, and manage applications in cloud computing.As the market leader and most ma...
Aviatrix Integration of a NextGen Firewall in AWS Transit Gateway
Learn how Aviatrix’s intelligent orchestration and control eliminates unwanted tradeoffs encountered when deploying Palo Alto Networks VM-Series Firewalls with AWS Transit Gateway.Deploying any next generation firewall in a public cloud environment is challenging, not because of the f...
AWS Config Best Practices for Compliance
Use AWS Config the Right Way for Successful ComplianceIt’s well-known that AWS Config is a powerful service for monitoring all changes across your resources. As AWS Config has constantly evolved and improved over the years, it has transformed into a true powerhouse for monitoring your...
Cloud Academy is Coming to the AWS Summits in Atlanta, London, and Chicago
Cloud Academy is a proud sponsor of the 2019 AWS Summits in Atlanta, London, and Chicago. We hope you plan to attend these free events that bring the cloud computing community together to connect, collaborate, and learn about AWS. These events are all about learning. You can learn how t...
How to Monitor Your AWS Infrastructure
The AWS cloud platform has made it easier than ever to be flexible, efficient, and cost-effective. However, monitoring your AWS infrastructure is the key to getting all of these benefits. Realizing these benefits requires that you follow AWS best practices which constantly change as AWS...