DNS & Deliverability
DNS Records
DNS configuration is the single biggest factor in whether your email reaches the inbox. This guide covers every record SendFleet uses, what each one does, how to add it, and how to confirm it worked.
Record overview
There are four records in total. The first two are required before you can send at all; the other two improve deliverability and bounce routing.
| Record | Required? | Purpose |
|---|---|---|
| Domain ownership TXT | Required | Two TXT records: SES's token proves you control the domain, and SendFleet's proves it is yours on this account. Nothing sends until both are verified. |
| DKIM CNAMEs (×3) | Required | Cryptographically signs your outgoing mail. Prevents spoofing and is the strongest single deliverability signal you control. |
| MAIL FROM MX + SPF | Recommended | Routes bounces properly and authorises sending from your subdomain. Needed for full DMARC alignment on SPF. |
| DMARC TXT | Recommended | Tells receiving servers what to do when SPF or DKIM fails, and gives you reporting on who is sending as your domain. |
How to configure DNS records for email deliverability
Four record groups. The first two are required before you can send; the last two are what move you up the inbox placement curve.
1: Domain ownership (TXT)
When you add a domain, SES issues a unique verification token. Publish it as a TXT record at _amazonses.yourdomain.com. Once SES sees it, ownership is verified.
Type: TXT Name: _amazonses.yourdomain.com Value: <token from your dashboard> TTL: 300
Publish a second TXT record at _sendfleet.yourdomain.com. Its value belongs to this domain on your account and never changes: remove the domain and add it again, or add it in the other sending mode, and the record you published still works. It proves to SendFleet that the domain is yours and not another account's that added the same name. Both records are required, on BYOC and Shared SES domains alike. A domain that was already verified before this record was introduced does not need it; its detail page does not show one.
Type: TXT Name: _sendfleet.yourdomain.com Value: sendfleet-verification=<value from your dashboard> TTL: 300
After adding both records, go to Dashboard → Domains → your domain → Verify ownership. The check queries SES and your DNS directly and updates immediately. If it fails, wait a few minutes and try again rather than changing the record.
2: DKIM (3 × CNAME)
DKIM attaches a cryptographic signature to every message you send. Receiving servers check that signature against the public key published in your DNS. Without it, many providers will flag your mail as suspicious or drop it silently.
SES generates three CNAME records and you must add all three. Adding only one or two produces intermittent signing failures, which are considerably harder to diagnose than an outright failure.
Type: CNAME Name: <token1>._domainkey.yourdomain.com Value: <token1>.dkim.amazonses.com Type: CNAME Name: <token2>._domainkey.yourdomain.com Value: <token2>.dkim.amazonses.com Type: CNAME Name: <token3>._domainkey.yourdomain.com Value: <token3>.dkim.amazonses.com TTL: 300 (for each)
With all three published, choose Verify DKIM on the domain detail page. Once it passes, the domain is send-ready and you can start sending immediately. DKIM alone gives you full DMARC alignment on your root domain, which is why SendFleet does not require a root SPF record before letting you send.
DKIM on BYOC domains
For BYOC domains the tokens come from your own AWS SES account. We request them using your IAM role and display the result, same process, different AWS account.
3: MAIL FROM subdomain (MX + SPF)
The MAIL FROM domain, also called the envelope sender or Return-Path, is separate from the From: address your recipients see. By default SES uses its own. Setting a custom one on a subdomain of yours, such as send.yourdomain.com, gives you a second authentication path alongside DKIM and routes bounces back through your domain.
SendFleet configures send.yourdomain.com as the MAIL FROM subdomain when you add a domain. You add two records for it:
# MX - routes bounces to SES. Use the hostname for YOUR SES region. Type: MX Name: send.yourdomain.com Value: 10 feedback-smtp.us-east-1.amazonses.com TTL: 300 # SPF - authorises SES to send from this subdomain Type: TXT Name: send.yourdomain.com Value: v=spf1 include:amazonses.com ~all TTL: 3600
| SES region | MX value |
|---|---|
| us-east-1 | feedback-smtp.us-east-1.amazonses.com |
| us-west-2 | feedback-smtp.us-west-2.amazonses.com |
| eu-west-1 | feedback-smtp.eu-west-1.amazonses.com |
| eu-central-1 | feedback-smtp.eu-central-1.amazonses.com |
| ap-southeast-1 | feedback-smtp.ap-southeast-1.amazonses.com |
| ap-southeast-2 | feedback-smtp.ap-southeast-2.amazonses.com |
| ap-northeast-1 | feedback-smtp.ap-northeast-1.amazonses.com |
| ap-south-1 | feedback-smtp.ap-south-1.amazonses.com |
| ca-central-1 | feedback-smtp.ca-central-1.amazonses.com |
| sa-east-1 | feedback-smtp.sa-east-1.amazonses.com |
Your dashboard shows the value for your region, so copy it from there rather than from this table. After publishing both records, choose Verify MAIL FROM on the domain detail page.
4: DMARC (TXT on the _dmarc subdomain)
DMARC tells receiving servers what to do with mail that fails SPF or DKIM, and enables aggregate reporting so you can see who is sending as your domain. It is the record that turns DKIM and SPF from signals into policy.
The domain detail page checks your live DNS before it suggests anything, so what you see depends on what is already published at _dmarc.yourdomain.com:
| What the dashboard finds | What you'll see | What to do |
|---|---|---|
| No DMARC record | The suggested record, ready to copy | Add it, then choose Verify DMARC |
| Exactly one valid record | Your existing record, marked verified | Nothing — you're already covered |
| Two or more v=DMARC1 records | A warning that DMARC is disabled entirely | Delete all but one record at that name |
Type: TXT Name: _dmarc.yourdomain.com Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com TTL: 3600
DMARC policy options
| Policy (p=) | Effect | When to use it |
|---|---|---|
| none | Monitor only. Failing mail is still delivered. | Start here. Collect reports before you enforce anything. |
| quarantine | Failing mail goes to spam or junk. | Once reports confirm all your legitimate sending sources are aligned. |
| reject | Failing mail is bounced outright. | Full enforcement. Maximum protection against spoofing. |
Complete checklist
Use this when setting up a new sending domain.
| Record | Type | Name | Where to check status |
|---|---|---|---|
| Domain ownership | TXT | _amazonses.yourdomain.com | Dashboard → SES status badge |
| SendFleet ownership | TXT | _sendfleet.yourdomain.com | Dashboard → SES status badge |
| DKIM key 1 | CNAME | <token1>._domainkey.yourdomain.com | Dashboard → DKIM badge |
| DKIM key 2 | CNAME | <token2>._domainkey.yourdomain.com | Dashboard → DKIM badge |
| DKIM key 3 | CNAME | <token3>._domainkey.yourdomain.com | Dashboard → DKIM badge |
| MAIL FROM MX | MX | send.yourdomain.com | Dashboard → MAIL FROM badge |
| MAIL FROM SPF | TXT | send.yourdomain.com | Dashboard → MAIL FROM badge |
| DMARC | TXT | _dmarc.yourdomain.com | Dashboard → DMARC badge, checked live on page load |
Troubleshooting
| Problem | Likely cause | Fix |
|---|---|---|
| Ownership verification keeps failing | The record has not propagated, or the subdomain prefix was doubled up. | Wait 15–30 minutes, then confirm both records with dig TXT _amazonses.yourdomain.com and dig TXT _sendfleet.yourdomain.com before clicking Verify again. |
| DKIM fails after adding records | Only one or two of the three CNAMEs were added, or the provider mangled a trailing dot. | Check all three with dig CNAME <token>._domainkey.yourdomain.com. Each must resolve to a .dkim.amazonses.com hostname. |
| MAIL FROM stays pending indefinitely | The MX record is missing, or points at the wrong region's endpoint. | Confirm the MX value matches your SES region exactly — a us-east-1 hostname on an eu-west-1 domain will never verify. |
| DMARC alignment failing despite DKIM passing | SPF is aligning against the SES default MAIL FROM rather than your domain. | Set up the custom MAIL FROM subdomain in step 3 so the Return-Path aligns with your domain. |
| Dashboard reports conflicting DMARC records | More than one v=DMARC1 TXT record exists at _dmarc.yourdomain.com, often because one was added manually and another by IT or a vendor. | Run dig TXT _dmarc.yourdomain.com, keep the single record you want enforced, and delete the rest. DMARC stays disabled until exactly one remains. |
| Everything verifies but mail still lands in spam | Authentication is necessary but not sufficient — content, sending history, and list quality all matter. | Confirm DMARC is published, warm up gradually on a new domain, and keep bounce and complaint rates low. |
Checking records with dig
You can verify any record from your terminal without waiting on the dashboard:
# Domain ownership TXT records dig TXT _amazonses.yourdomain.com +short dig TXT _sendfleet.yourdomain.com +short # DKIM CNAME - repeat for each of the three tokens dig CNAME token1._domainkey.yourdomain.com +short # MAIL FROM MX dig MX send.yourdomain.com +short # MAIL FROM SPF - on the subdomain, not the root dig TXT send.yourdomain.com +short # DMARC - count the v=DMARC1 records returned, not just the first dig TXT _dmarc.yourdomain.com +short
On Windows, nslookup -type=TXT _amazonses.yourdomain.com (and the same for _sendfleet) does the same job.
Frequently asked questions
The DNS questions that come up most, from DKIM rotation to SPF conflicts and propagation delay.