Custom MAIL FROM domain in AWS SES

DKIM ( 0019 DKIM verification with AWS SES Easy DKIM · DevOps ) signs the visible From: header. But every email has a second sender identity — the SMTP envelope sender (MAIL FROM, surfaced to receivers as the Return-Path header) — and by default in AWS SES this address sits on a subdomain of amazonses.com. That default works, but it breaks SPF alignment under DMARC. DMARC’s relaxed mode (the default) requires the SPF-authenticated domain to share an organizational domain with the visible From: — and amazonses.com doesn’t share one with example.com. Strict mode requires an exact match, which fails even harder. Either way, SPF alignment is broken.

The fix is a “custom MAIL FROM domain” — a subdomain of your sending domain that SES uses as the envelope sender. Aligning the envelope’s organizational domain (example.com) with the visible From: domain (example.com) restores SPF alignment under relaxed mode.

Concept

MAIL FROM (envelope sender)

The address SMTP servers use to report bounces and that SPF is evaluated against — separate from the visible `From:` header.

When a relay can’t deliver a message, it returns the bounce to the MAIL FROM address, not to From:. SPF authenticates whether the sending IP is allowed to send for the MAIL FROM domain. If MAIL FROM is on amazonses.com but From: is on example.com, SPF passes for amazonses.com but the result doesn’t align with From: — and DMARC requires alignment.

The naming rules — and the one that catches everyone

Pick a subdomain of your sending domain. SES generates the actual MAIL FROM address dynamically (something like [email protected]) — you only control the subdomain.

Role	Example
Onboarding domain	example.com
Sender domain (From:)	example.com
MAIL FROM domain	mailfrom.example.com or mf1.example.com
Sender email (From:)	[email protected]
MAIL FROM address (generated)	[email protected]

The two DNS records, no more, no less

1. Pick the subdomain in the SES console

   Under your domain identity, set the MAIL FROM subdomain (for example, mailfrom.example.com). SES shows you the records to publish next.

2. Publish exactly one MX record

   The MX record points the envelope’s bounce mailbox at SES’s feedback handler in the same region.

   Name	Type	Value
   mailfrom.example.com	MX	10 feedback-smtp.{region}.amazonses.com

   The 10 is the MX preference; most DNS hosts ask for it as a separate numeric field.

3. Publish the SPF TXT record

   The TXT record authorizes SES’s IPs to send for this subdomain. SPF is evaluated against this domain, so the include must list amazonses.com.

   Name	Type	Value
   mailfrom.example.com	TXT	"v=spf1 include:amazonses.com ~all"

   AWS docs show the value with literal quotes because that’s the zone-file syntax. Most UI-based DNS hosts (Route 53, Cloudflare, Cloud DNS) handle quoting themselves — paste the value without the surrounding "…". If your DNS host is a raw zone-file editor, keep the quotes.

4. Verify the records resolve

   Use nslookup on both records (see 0022 Verifying AWS DNS records with nslookup · DevOps ). SES re-polls and flips the MAIL FROM status to Success once the MX and TXT both resolve correctly.

Why these two records, and what each one buys you

SPF alignment under DMARC is the third thing this setup buys you, even though it isn’t on the wire diagram: receivers compare the SPF-authenticated MAIL FROM domain to the visible From: domain and treat the message as SPF-aligned when the organizational domain matches (both example.com).

• TXT (SPF): receivers check this to decide if SES is allowed to send for the MAIL FROM subdomain. Without it, SPF fails, and DMARC fails with it.
• MX: when a destination MTA bounces the message, it routes the bounce to the MAIL FROM address — which has to resolve back to SES so SES can process the bounce and update the suppression list. Without the MX, bounces vanish.

DMARC alignment requires either SPF or DKIM to align with the visible From: header. DKIM ( 0019 DKIM verification with AWS SES Easy DKIM · DevOps ) usually aligns by default; SPF only aligns when you publish a custom MAIL FROM. Doing both is belt-and-braces and the right default.

Reference

• AWS SES — Using a custom MAIL FROM domain