DKIM Setup for Amazon SES

January 17, 2026 • InboxGreenEmail Team

🚨 DKIM issues can silently kill replies.

If opens dropped, replies disappeared, or bounces increased, treat it as an incident. Run the scan and get a fix path.

No signup required. Works on any domain.

search Run a Free Domain Check notifications_active Monitor my domain

DKIM Setup for Amazon SES

Setting up DKIM for Amazon SES can feel daunting, especially if you are new to email authentication. However, it's crucial for ensuring your emails land in the inbox instead of the spam folder. A properly configured DKIM can enhance your domain's reputation, reduce the chances of bounced emails, and prevent your messages from being flagged as spam. When you start seeing warnings in Gmail or notice that your emails are bouncing, it becomes urgent to address these issues. Without DKIM, your emails may not be trusted by ISPs, which can severely impact your deliverability.

At a glance

  • This problem affects SaaS founders, marketers, and technical email managers.
  • This article will guide you through the DKIM setup process for Amazon SES.
  • By following these steps, you will improve your inbox placement and domain reputation.

When this problem shows up in real life

Imagine you are sending out a marketing email campaign, but your open rates are dismal. You check the logs and find that emails are bouncing or going straight to spam. You might see error messages like:

  • 554 Message rejected: Email address is not verified.
  • Authentication-Results: dkim=fail (bad signature)

In another case, you check a support ticket from a user who claims they never received your email. After some digging, you find that the email was flagged as spam. The headers reveal:


Received: from example.com (mail.example.com. [192.0.2.1]) by mx.google.com with ESMTPS id abcdefg12345 for <[email protected]> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256); Mon, 01 Jan 2023 12:34:56 -0700 (PDT)
Authentication-Results: mx.google.com; dkim=fail [email protected]

These scenarios highlight the importance of DKIM. Without it, you risk damaging your sender reputation and losing valuable engagement.

Step by step: DKIM setup for Amazon SES

  1. Log in to your AWS Management Console.

    Navigate to the Amazon SES dashboard. Ensure you are in the correct region where you want to set up DKIM.

  2. Verify your domain.

    If you haven't done this yet, you need to verify your domain in Amazon SES. Go to the "Domains" section and click on "Verify a New Domain."

    • Enter your domain name.
    • Select "Generate DKIM Settings."
  3. Add DKIM records to your DNS.

    Amazon SES will provide you with three CNAME records. You need to add these to your DNS settings. Here is an example of what the records might look like:

    
example._domainkey.example.com. 300 IN CNAME example.dkim.amazonses.com.
example2._domainkey.example.com. 300 IN CNAME example2.dkim.amazonses.com.
example3._domainkey.example.com. 300 IN CNAME example3.dkim.amazonses.com.
  4. Verify DKIM setup in Amazon SES.

    Once you have added the records, return to the Amazon SES dashboard. It may take some time for DNS changes to propagate. Click on your domain and check the DKIM status. It should show as "verified."

  5. Test your DKIM configuration.

    Send a test email to a Gmail account and check the headers. Look for:

    
Authentication-Results: mx.google.com; dkim=pass [email protected]

    If you see "dkim=pass," your setup is successful.

Common mistakes

  • Not verifying the domain first.

    Symptom: DKIM records do not work.

    Cause: The domain is not verified in Amazon SES.

    Fix: Verify your domain in the SES dashboard before adding DKIM records.

  • Incorrect CNAME records.

    Symptom: DKIM status shows as "not verified."

    Cause: Typos or incorrect values in the CNAME records.

    Fix: Double-check the records you added to your DNS settings.

  • DNS propagation delays.

    Symptom: DKIM status remains unverified even after adding records.

    Cause: DNS changes can take time to propagate.

    Fix: Wait a few hours and check again.

  • Not testing DKIM after setup.

    Symptom: Emails still go to spam.

    Cause: DKIM might not be set up correctly.

    Fix: Send a test email and check the headers for DKIM results.

Troubleshooting when it still fails

  • DKIM shows as "not verified" → Likely cause: DNS records not found.

    What to try next: Use a DNS TXT Lookup tool to check if your DKIM records are visible.

  • Authentication-Results shows "dkim=fail" → Likely cause: Incorrect CNAME records.

    What to try next: Verify the CNAME records in your DNS settings match those provided by Amazon SES.

  • Emails still landing in spam → Likely cause: Other authentication issues.

    What to try next: Check your SPF and DMARC records. You can use the InboxGreen checker for a complete analysis.

Related checks you should run

  • SPF, DKIM, and DMARC alignment.
  • DNS TTL and propagation delays.
  • Domain reputation, bounces, and spam reports.
  • List quality and engagement patterns.

FAQ

Why is DKIM still failing on Amazon SES after I added the record?

This could be due to DNS propagation delays or incorrect CNAME records. Make sure that the records you added match exactly what Amazon SES provided.

How long do DNS changes take to apply on Amazon SES?

DNS changes can take anywhere from a few minutes to 48 hours to propagate. Typically, you should see changes within a few hours.

Can I use more than one DKIM key with Amazon SES?

Yes, you can set up multiple DKIM keys, but you will need to manage them carefully. Each domain can have its own DKIM settings.

What if my emails are still going to spam after DKIM setup?

If your emails are still landing in spam, check your SPF and DMARC records. Also, ensure that your sending practices align with best practices for email engagement.

What to do next

Now that you have set up DKIM for Amazon SES, it is essential to monitor your email deliverability. Use the InboxGreen checker to ensure everything is functioning as expected. Regularly check your SPF and DMARC records as well. This proactive approach will help maintain your domain's reputation and improve inbox placement. Don't hesitate to explore other tools on InboxGreen to further enhance your email authentication strategy.

Free Deliverability Scan

Check SPF, DKIM, DMARC and List-Unsubscribe for your domain in seconds.