Domains and DNS

What DKIM, SPF, and DMARC actually do, how to publish them, and how to tell when one is wrong.

Mail only leaves OutSend for domains you have proven you control. That is three DNS records and one button.

The three records

DKIM

Host:  mail._domainkey.yourdomain.com
Type:  TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A…

We generate a keypair per domain and keep the private half. The public half goes in DNS, and receiving providers use it to check that a message really came from you and was not altered on the way. The selector is mail.

SPF

Host:  yourdomain.com
Type:  TXT
Value: v=spf1 include:amazonses.com ~all

SPF lists who is allowed to send for your domain. If you already have an SPF record, merge into it — do not add a second one. Two SPF records is a misconfiguration and providers will treat it as a failure.

DMARC

Host:  _dmarc.yourdomain.com
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

DMARC tells providers what to do when DKIM and SPF disagree with the visible From address. Start at p=none, which asks for reports without changing handling, and read the reports for a few weeks before tightening to quarantine or reject.

Verifying

Press Verify after publishing. Each record is checked independently, so you can see exactly which one has not propagated. The domain stays pending until all three pass — it does not fail, it just waits.

Checking yourself:

dig +short TXT mail._domainkey.yourdomain.com
dig +short TXT yourdomain.com
dig +short TXT _dmarc.yourdomain.com

Regions

Each domain sends from an AWS region you choose, default us-east-1. This is where your mail is processed, so pick it deliberately if data residency matters to you. It is set per domain, not per account.

Open and click tracking

Both are per-domain toggles, and both are off-by-default decisions you should make consciously. Tracking rewrites links and adds a pixel; some audiences will care and some regulations will too. Turning them off means open and click events stop firing — everything else is unaffected.

Reputation

Reputation is scored per domain as well as per workspace. Concentrated bounces or complaints on one domain do not contaminate your others, and a workspace that crosses the threshold is disabled automatically — with queued mail failing loudly rather than sending.

You will be told when this happens and why, with the events that caused it.