MailFixIt

Amazon SES email configuration guide

Amazon SES: custom MAIL FROM SPF not passing

SES SPF is evaluated at the envelope MAIL FROM domain; for a custom MAIL FROM setup, that is normally a dedicated subdomain.

Problem description

A provider setup symptom may look like:

An SES message reports SPF fail for its custom MAIL FROM subdomain.

Check the sending domain

What this usually means

The message used a custom MAIL FROM domain whose SPF record is missing, wrong, or published at another DNS name. SES default MAIL FROM domains are managed by AWS and do not require an SPF record at your visible From domain.

Fix it

  1. Open the SES identity in the sending AWS Region and note the exact custom MAIL FROM subdomain.
  2. Copy the SPF TXT and Region-specific feedback MX records shown for that subdomain.
  3. Publish the SPF policy at the custom MAIL FROM subdomain, keeping exactly one v=spf1 record there.
  4. Publish exactly the MX configuration SES requires for that custom MAIL FROM name; extra MX records can prevent setup.
  5. Wait for SES to report success, send a new message, and confirm that Return-Path uses the subdomain and SPF passes.

Common mistake

Publishing the SES SPF mechanism only at the visible From domain does not fix SPF for a different Return-Path. SPF pass also satisfies DMARC only when that envelope domain aligns with From, unless aligned DKIM passes instead.

What MailFixIt can check

MailFixIt can trace public SPF for the envelope domain. It cannot see the selected SES Region or custom MAIL FROM fallback behavior.

Use the related SPF guide for duplicate records, invalid syntax, or a failing dependency.

Frequently asked questions

What does MailFixIt check for Amazon SES?

It can evaluate the SPF policy at the actual envelope domain and detect duplicate, invalid, or unauthorized paths. SES must confirm custom MAIL FROM status.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: Amazon SES custom MAIL FROM domain setup.