Every email has two senders. The From address is what the recipient sees. The MAIL FROM address is the envelope sender, used by servers to route bounces back, and it is the domain SPF checks.
Why SES needs it
By default Amazon SES uses a subdomain of its own as the MAIL FROM domain. SPF passes, but for Amazon’s domain rather than yours, so it does not align with your From address. With DKIM aligned, DMARC still passes. A custom MAIL FROM domain gives you the second route.
It also puts your domain, not Amazon’s, in the bounce address, which some mailbox providers like to see.
The records
Pick a subdomain you will not use for anything else, such as bounce.example.com, and publish two records. AWS says to publish exactly one MX record, since several make the setup fail:
| Type | Name | Value |
|---|---|---|
| MX | bounce.example.com |
feedback-smtp.<region>.amazonses.com, priority 10 |
| TXT | bounce.example.com |
v=spf1 include:amazonses.com ~all |
Then enable the custom MAIL FROM domain in the SES identity settings. Use the region you send from in the MX value.
Things that go wrong
- Using a subdomain that already has MX records for real mail.
- Publishing the records at the wrong name, for example with the domain appended twice.
- Choosing a domain outside the identity you verified.
- Removing the MX record during a DNS clean-up.
The SPF record stays small because it covers only this subdomain. That is also why you usually do not need SPF flattening for SES.
Common questions
Can I use my main domain as the MAIL FROM domain?
No. It has to be a subdomain of the parent domain of a verified identity. AWS also says it should not be a subdomain you send from or receive mail on.
What happens if the MX record is missing?
It depends on the option you chose in SES. Either SES uses its default MAIL FROM domain, so SPF stops aligning with your From address, or it rejects the message with a MailFromDomainNotVerified error.