---
title: "Learning to Configure SPF for Amazon SES | DMARC Report"
description: "Learning to Configure SPF for Amazon SES from DMARC Report explains practical steps for email authentication, domain protection, deliverability, and DMARC."
image: "https://dmarcreport.com/og/blog/learning-to-configure-spf-for-amazon-ses.png"
canonical: "https://dmarcreport.com/blog/learning-to-configure-spf-for-amazon-ses/"
---

Quick Answer

Per RFC 7208, SPF evaluation is capped at 10 DNS mechanism lookups and 2 void lookups per check - exceeding either limit produces a \`PermError\` that fails authentication for every message from the domain. DMARC Report Learning to Configure SPF for Amazon SES

Related: [How to Create an SPF Record](/tools/spf-record-generator/) ·[SPF Record Format](/blog/spf-format-checker-dos-and-donts-for-email-authentication/) 

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Flearning-to-configure-spf-for-amazon-ses%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Learning%20to%20Configure%20SPF%20for%20Amazon%20SES&url=undefined%2Fblog%2Flearning-to-configure-spf-for-amazon-ses%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Flearning-to-configure-spf-for-amazon-ses%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Flearning-to-configure-spf-for-amazon-ses%2F&title=Learning%20to%20Configure%20SPF%20for%20Amazon%20SES "Share on Reddit") [ ](mailto:?subject=Learning%20to%20Configure%20SPF%20for%20Amazon%20SES&body=Check out this article: undefined%2Fblog%2Flearning-to-configure-spf-for-amazon-ses%2F "Share via Email") 

![Learning to Configure SPF for Amazon SES](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-record-6071.jpg) 

![How to create dmarc record 4445 150x150](https://media.mailhop.org/dmarcreport/images/2024/06/how-to-create-dmarc-record-4445-150x150.jpg) 

> The most common mistake we see during DMARC setup is jumping straight to p=reject without monitoring first, says Vasile Diaconu, Operations Lead at DuoCircle. Start at p=none, analyze your reports for at least a full quarter - you need to catch monthly, quarterly, and annual email senders that only fire periodically. Then fix any legitimate senders that fail before enforcing. We walk every customer through this sequence.

Per [RFC 7208](https://datatracker.ietf.org/doc/html/rfc7208), SPF evaluation is capped at 10 DNS mechanism lookups and 2 void lookups per check - exceeding either limit produces a `PermError` that fails authentication for every message from the domain. DMARC Report

Learning to Configure SPF for Amazon SES

```
					<button title="Play" aria-label="Play Episode" aria-pressed="false" class="play-btn">
						
```

Play Episode

```
					</button>
					<button title="Pause" aria-label="Pause Episode" aria-pressed="false" class="pause-btn hide">
						
```

Pause Episode

```
					</button>
				

					<audio preload="none" class="clip clip-13417">
						<source src="https://media.mailhop.org/dmarcreport/images/2024/06/Learning-To-Configure-Spf-For-Amazon-Ses.mp3">
					</audio>
						

							<button class="player-btn player-btn__volume" title="Mute/Unmute">
								
```

Mute/Unmute Episode

```
							</button>
							<button data-skip="-10" class="player-btn player-btn__rwd" title="Rewind 10 seconds">
								
```

Rewind 10 Seconds

```
							</button>
							<button data-speed="1" class="player-btn player-btn__speed" title="Playback Speed" aria-label="Playback Speed">1x</button>
							<button data-skip="30" class="player-btn player-btn__fwd" title="Fast Forward 30 seconds">
								
```

Fast Forward 30 seconds

```
							</button>
						

							<time class="ssp-timer">00:00</time>
							
```

/

```
							<!-- We need actual duration here from the server -->
							<time class="ssp-duration" datetime="PT0H1M47S">1:47</time>
			

								<nav class="player-panels-nav">
												<button class="subscribe-btn" id="subscribe-btn-13417" title="Subscribe">Subscribe</button>
																		<button class="share-btn" id="share-btn-13417" title="Share">Share</button>
										</nav>

						
```

RSS Feed

```
							<input value="https://dmarcreport.com/feed/podcast/dmarc-report" class="input-rss input-rss-13417" title="RSS Feed URL" readonly />
						

						<button class="copy-rss copy-rss-13417" title="Copy RSS Feed URL" aria-label="Copy RSS Feed URL"></button>
					

						Share						
					

						<a href="https://www.facebook.com/sharer/sharer.php?u=https://dmarcreport.com/blog/podcast/learning-to-configure-spf-for-amazon-ses/&t=Learning to Configure SPF for Amazon SES" target="blank" rel="noopener noreferrer" class="share-icon facebook" title="Share on Facebook">
							

						</a>
						<a href="https://twitter.com/intent/tweet?text=https://dmarcreport.com/blog/podcast/learning-to-configure-spf-for-amazon-ses/&url=Learning to Configure SPF for Amazon SES" target="blank" rel="noopener noreferrer" class="share-icon twitter" title="Share on Twitter">
							

						</a>
						<a href="https://media.mailhop.org/dmarcreport/images/2024/06/Learning-To-Configure-Spf-For-Amazon-Ses.mp3" target="blank" rel="noopener noreferrer" class="share-icon download" title="Download" download>
							

						</a>
					

						Link						
					

						<input value="https://dmarcreport.com/blog/podcast/learning-to-configure-spf-for-amazon-ses/" class="input-link input-link-13417" title="Episode URL" readonly />
					

					<button class="copy-link copy-link-13417" title="Copy Episode URL" aria-label="Copy Episode URL" readonly=""></button>
					

						Embed						

					
```

/\*! This file is auto-generated \*/ ’ title=“Embed Code” class=“input-embed input-embed-13417” readonly/>

```
					<button class="copy-embed copy-embed-13417" title="Copy Embed Code" aria-label="Copy Embed Code"></button>


```

If you send emails from Amazon SES and see the ‘**Via amazonses.com’ warning**, then you need to [set up SPF and DKIM](https://dmarcreport.com/blog/dmarc-google-workspace-gmail-setup-2026/). _This warning basically indicates that the mailbox provider perceived that your emails were sent from Amazon SES and not your brand_.

This blog guides you on setting SPF for \*\*Amazon SES so that there are no compliance issues and your business stays protected from the [growing phishing and spoofing attacks](https://dazeinfo.com/2024/06/03/the-ai-phishing-emails-are-new-nightmares-automation-helping-cybercriminals-to-reduce-attack-costs-by-over-95/).

However, please bear in mind that if you send emails from **subdomain.amazonses.com**, there is no need to set up SPF. In this case, Amazon takes care of [email authentication](https://dmarcreport.com/blog/why-email-security-matters-and-how-to-get-it-right/) using SPF and [DKIM](https://dmarcreport.com/what-is-dkim/). If you want to set up [DMARC](https://dmarcreport.com/) for your domain, please contact with DMARCReport.com.

## Step 1: Domain Verification With Amazon SES

It’s a simple 6-step process. Here’s what you need to do-

- Log in to the [AWS Management Console](https://signin.aws.amazon.com/signin?redirect%5Furi=https%3A%2F%2Fhealth.aws.amazon.com%2Fhealth%2Fhome%3Fstate%3DhashArgs%2523%26isauthcode%3Dtrue&client%5Fid=arn%3Aaws%3Aiam%3A%3A015428540659%3Auser%2Fphd-console&forceMobileApp=0&code%5Fchallenge=ok4q%5Fv45nKIA%5FooXm6SkqMeGAu72Vs2zboe5pV%5FauSU&code%5Fchallenge%5Fmethod=SHA-256).
- Go to the Amazon SES interface.
- In the navigation panel, select ‘Domains’ under ‘Identity Management.’
- Click ‘Verify a New Domain.’
- Enter your domain name and click ‘**Verify this Domain**.’
- Add the provided TXT record to your [DNS configuration](https://phoenixnap.com/kb/dns-configuration) to verify the domain.
![How to create dmarc record](https://media.mailhop.org/dmarcreport/images/2024/06/how-to-create-dmarc-record-7570.jpg) 

## Step 2: DNS Record Configuration

After you are done verifying your domain , add an SPF record to your domain’s **DNS settings**. Follow these steps and get this done-

- Log in to your DNS provider’s management console.
- Go to the **DNS management section**.
- Add a new [TXT record](https://en.wikipedia.org/wiki/TXT%5Frecord) with:
- type: TXT
- Name: @ (or your domain name, depending on the DNS provider)
- Value: “v=spf1 include:amazonses.com \~all”

## Step 3: Confirmation of the SPF Record

Check your domain’s \*\*DNS settings to ensure your SPF record has no configurational and syntactical errors.

- Use an SPF lookup tool like MXToolbox.
- Enter your domain name.
- _Check the SPF record to ensure it includes ‘include.com_.’

## Step 4: Test Sending Emails

Finally, \*\*test sending emails from your domain using Amazon SES. Send a test email from an application or the SES console. Then, check the [email headers](https://proton.me/blog/what-are-email-headers) of the received email for ‘Received-SPF: pass’ to ensure that SPF passes.

## How Do You Configure up the MAIL FROM Domain?

- Go to your Amazon SES console and select ‘Domains’ under ‘Identity Management.’
- _Confirm that the parent domain of the MAIL FROM domain is in the list of validated domains_.
- Select the MAIL FROM domain.
- In the ‘Set MAIL FROM Domain’ window, enter the subdomain you want to use.
- A new window will display the SPF and MX records for your domain’s **DNS setup**.

The following table demonstrates the format of these records-

\*\*NameTypeValue subdomain.domain.com

mx

10 feedback-smtp.region.amazonses.com

subdomain.domain.com

txt

v=spf1 include:amazonses.com -all

- Lastly, publish an \*\*MX record in the [DNS server](https://www.ibm.com/topics/dns-server) of the unique MAIL FROM domain.
![Dmarc office 365](https://media.mailhop.org/dmarcreport/images/2024/06/dmarc-office-365-36.jpg) 

## Final Words

[SPF](https://dmarcreport.com/what-is-spf/) ensures that only authorized people send emails as representatives of your brand. This minimizes the chances for threat actors to exploit your email-sending domain to send \*\*fraudulent emails posing as one of your representatives.

If you use Amazon SES to send marketing, notification, and **transactional emails**, then the above guide will surely help you. However, we know how this process can be a bit complex to understand. So, if you feel like having a helping hand by your side, [reach out to us](https://autospf.com/contact-us/?%5Fgl=1%2Avklt6o%2A%5Fup%2AMQ..%2A%5Fga%2AMjI5MjA4NTUwLjE3MTc2OTA1Mjc.%2A%5Fga%5F5J0R8M01Y5%2AMTcxNzY5MDUyNy4xLjAuMTcxNzY5MDUyNy4wLjAuMA..)!

## Topics

[ dkim ](/tags/dkim/)[ dns record ](/tags/dns-record/)[ SPF ](/tags/spf/) 

![Vishal Lamba](https://media.mailhop.org/dmarcreport/images/team/vishal-lamba.jpg) 

[ Vishal Lamba ](/authors/vishal-lamba/) 

Content Specialist

Content Specialist at DMARC Report. Writes vendor-specific email authentication guides and troubleshooting walkthroughs.

[LinkedIn Profile →](https://www.linkedin.com/in/vishal-lamba/) 

## Take control of your DMARC reports

Turn raw XML into actionable dashboards. Start free - no credit card required.

[Start Free Trial](https://app.dmarcreport.com/) [Check Your DMARC Record](/tools/dmarc-checker/) 

## Related Articles

[  Intermediate 8m  Decoding I-Tag DKIM Vulnerability and Its Impact on Email Deliverability and Security  Jun 6, 2024 ](/blog/decoding-i-tag-dkim-vulnerability-and-its-impact-on-email-security/)[  Intermediate 4m  Does DKIM break for forwarded emails and mailing lists?  Jul 11, 2024 ](/blog/does-dkim-break-for-forwarded-emails-and-mailing-lists/)[  Intermediate 4m  Getting Rid of Common SPF Errors for Email Security and Delivery  Dec 20, 2023 ](/blog/getting-rid-of-common-spf-errors-for-email-security-and-delivery/)[  Intermediate 6m  The Definitive Guide To Configuring SPF and DKIM for Salsa Labs  Jan 12, 2026 ](/blog/how-to-configure-spf-and-dkim-in-salsa-labs/)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"470","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"Learning to Configure SPF for Amazon SES","description":"Learning to Configure SPF for Amazon SES from DMARC Report explains practical steps for email authentication, domain protection, deliverability, and DMARC.","url":"https://dmarcreport.com/blog/learning-to-configure-spf-for-amazon-ses/","datePublished":"2024-06-10T12:04:51.000Z","dateModified":"2026-04-16T15:53:43.000Z","dateCreated":"2024-06-10T12:04:51.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/vishal-lamba/#person","name":"Vishal Lamba","url":"https://dmarcreport.com/authors/vishal-lamba/","jobTitle":"Content Specialist","description":"Vishal Lamba writes DMARC Report's how-to guides and vendor-specific configuration walkthroughs. His work focuses on step-by-step implementation guides for major email platforms (Google Workspace, Microsoft 365, SendGrid, Mimecast, Proofpoint, Brevo, and others), troubleshooting common SPF and DMARC errors, and translating RFC-level specifications into practical deployment procedures for IT administrators.","image":"https://media.mailhop.org/dmarcreport/images/team/vishal-lamba.jpg","knowsAbout":["SPF Vendor Configuration","Email Platform Integrations","SPF Troubleshooting","Technical Documentation","Step-by-Step Guides"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/vishal-lamba/"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"470","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/learning-to-configure-spf-for-amazon-ses/"},"articleSection":"intermediate","keywords":"dkim, dns record, SPF","wordCount":833,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-record-6071.jpg","caption":"Learning to Configure SPF for Amazon SES","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"Learning to Configure SPF for Amazon SES","item":"https://dmarcreport.com/blog/learning-to-configure-spf-for-amazon-ses/"}]}
```