InboxAudit

Amazon SES email authentication

AWS’s bulk and transactional sending API; the cheapest option at volume.

SES verifies each identity separately. Region-specific includes such as eu-west-1.amazonses.com also exist.

SPF record

Add Amazon SES to your domain's SPF record with this include:

include:amazonses.com

A complete record for a domain sending only through Amazon SES:

v=spf1 include:amazonses.com ~all

What it costs you

1 of your 10 DNS lookups. That is the cheapest an include can be — the record it points at contains only IP ranges, with no further includes to follow. Behind it are 12 IP ranges.

Live record

This is what amazonses.com published when this page was generated:

v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 ip4:69.169.224.0/20 ip4:23.249.208.0/20 ip4:23.251.224.0/19 ip4:76.223.176.0/20 ip4:54.240.64.0/18 ip4:76.223.128.0/19 ip4:216.221.160.0/19 ip4:206.55.144.0/20 ip4:24.110.64.0/18 -all

DKIM

Enable DKIM inside Amazon SES and publish the selector record it generates. DKIM matters more than SPF for deliverability, because a DKIM signature survives forwarding while SPF does not — see how selectors work.

DMARC

Neither SPF nor DKIM protects the address your recipients actually see until DMARC ties them to it. Once Amazon SES is authenticating, publish a DMARC record — start at p=none with a reporting address and tighten from there.

Generate a DMARC record →

Check it worked

DNS changes take minutes to hours to propagate. Once published, run the domain through the checker — it resolves the full include chain and reports the real lookup count.

Official documentation

Amazon SES setup docs →