Known quirk
Amazon SES's SPF may not line up with your domain
We didn't find a custom MAIL FROM domain for SES, so its SPF won't line up with your domain. That's normal for SES. Your mail is still authenticated, because SES signs it with your DKIM key.
What this means for you
- Nothing to change while DKIM keeps signing.
- In DMARC reports, SES mail shows SPF not aligned and DKIM aligned. That's expected.
- A custom MAIL FROM subdomain in SES lines SPF up too. If you have one on a subdomain we don't check, this note doesn't apply.
If SES mail stops signing with DKIM, your report shows it as a gap.
Why it happens
SPF checks the hidden bounce address, not the one people see. SES tracks bounces and complaints with an address it owns, so SPF passes for SES's domain, not yours. DMARC only needs SPF or DKIM to match, and DKIM does.
Technical detail
SES's default MAIL FROM is an Amazon SES domain, so SPF isn't aligned with the From domain. SPF alignment needs a custom MAIL FROM domain under yours, and relaxed SPF alignment (no aspf=s). DMARC passes through Easy DKIM's aligned signature.
amazon-ses.spf_default_mail_from
Sources
Reviewed by healthcheck.email on 2026-10-09.