Amazon SES SPF record
Amazon SES authorizes with a single all-IP include, amazonses.com. Like SendGrid, SES also supports a custom MAIL FROM subdomain that keeps SPF validation off your root domain.
The SPF include for Amazon SES
Authorize Amazon SES by adding its mechanism to your single SPF TXT record:
v=spf1 include:amazonses.com ~allApproximate lookup cost: 1 DNS lookup(s). Remember you have a budget of 10 total across every sender in the record.
Provider include values change occasionally. Confirm the current value in your
Amazon SES admin console before publishing, and never create a second
v=spf1 record — a domain may have only one.
Combine all senders into one record:
v=spf1 include:spf.protection.outlook.com include:amazonses.com ~allBest practice: configure a custom MAIL FROM domain in SES. SPF is then checked on that subdomain, sparing your root record’s lookup budget — the same subdomain principle that makes SES and SendGrid easy to add without cost.
When adding Amazon SES pushes you over the limit
Every include you stack — your mailbox provider, this one, a marketing tool, a
help desk — adds to the same 10-lookup budget. The moment recursive expansion crosses
10, receivers return permerror and your SPF stops
passing. You cannot shrink the nested provider records, so the durable fix is to
flatten the record or move to a
single-lookup macro that stays in sync automatically.
Frequently asked questions
What is the SPF include for Amazon SES?
include:amazonses.com to your single SPF record, e.g. v=spf1 include:amazonses.com ~all. Verify the current value in your Amazon SES admin console.How many DNS lookups does it use?
Can I have a separate SPF record just for this provider?
v=spf1) record. Publishing two causes a permerror. Merge every sender into a single record.