Properly configured DNS records are essential for email deliverability. They prove to receiving mail servers that your messages are legitimate and haven't been tampered with. This guide covers every DNS record you should configure for a domain verified in SendOps.

## DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every email you send. Receiving servers use the public key published in your DNS to verify that the message was actually sent by your domain and wasn't altered in transit.

When you [add a domain](/domains/adding-a-domain) in SendOps, SES generates three DKIM signing key pairs and provides three CNAME records to publish.

### DKIM records

| Type | Name | Value |
|------|------|-------|
| CNAME | `{token1}._domainkey.example.com` | `{token1}.dkim.amazonses.com` |
| CNAME | `{token2}._domainkey.example.com` | `{token2}.dkim.amazonses.com` |
| CNAME | `{token3}._domainkey.example.com` | `{token3}.dkim.amazonses.com` |

The token values are unique to your domain and are generated by AWS SES. Copy them from the SendOps dashboard to avoid errors.

**Why three records?** SES uses key rotation. Having three selectors allows SES to rotate signing keys automatically without any downtime or manual intervention on your part.

All three CNAME records must be added for DKIM to be fully enabled. Once they propagate, SendOps will show DKIM status as **Verified**.

## SPF (Sender Policy Framework)

SPF tells receiving servers which mail servers are authorized to send email on behalf of your domain. For SES, you need to include Amazon's SPF record.

When you add a domain, SendOps generates a recommended SPF record and displays it in the dashboard. The recommended value is:

### SPF record

| Type | Name | Value |
|------|------|-------|
| TXT | `example.com` | `v=spf1 include:amazonses.com ~all` |


  A domain can only have **one** SPF TXT record. If you already have an SPF record (e.g., for Google Workspace or another provider), **merge** the includes into a single record rather than creating a second one. For example:

  ```
  v=spf1 include:_spf.google.com include:amazonses.com ~all
  ```

  Multiple SPF records on the same domain will cause validation failures.


### SPF mechanism reference

| Mechanism | Meaning |
|-----------|---------|
| `include:amazonses.com` | Authorize Amazon SES servers to send on your behalf |
| `~all` | Soft-fail messages from unauthorized servers (recommended starting point) |
| `-all` | Hard-fail messages from unauthorized servers (stricter, use after confirming everything works) |

## DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC ties DKIM and SPF together and tells receiving servers what to do when a message fails authentication. It also enables reporting so you can monitor authentication results.

When you add a domain, SendOps generates a recommended DMARC record and displays it in the dashboard. The default record uses `p=quarantine` with reports sent to `dmarc@yourdomain.com`:

### DMARC record

| Type | Name | Value |
|------|------|-------|
| TXT | `_dmarc.example.com` | `v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com` |

### Policy options

| Policy (`p=`) | Behavior | When to use |
|---------------|----------|-------------|
| `quarantine` | Mark failing messages as spam | Default policy generated by SendOps |
| `reject` | Reject failing messages outright | Full enforcement after confidence in your authentication setup |
| `none` | Take no action, just collect reports | Monitoring only, while reviewing reports |


  The DMARC record generated by SendOps uses `p=quarantine` by default. This provides immediate protection by directing receiving servers to treat unauthenticated messages as suspicious. You can adjust the policy value in your DNS if needed -- for example, moving to `reject` once you have confirmed all legitimate sending sources pass DKIM and SPF.


### DMARC tag reference

| Tag | Required | Example | Purpose |
|-----|----------|---------|---------|
| `v` | Yes | `DMARC1` | Protocol version |
| `p` | Yes | `quarantine`, `reject`, `none` | Policy for messages that fail authentication |
| `rua` | No | `mailto:dmarc@example.com` | Address to receive aggregate reports |
| `ruf` | No | `mailto:dmarc-forensic@example.com` | Address to receive forensic (failure) reports |
| `pct` | No | `100` | Percentage of messages to apply the policy to (default 100) |
| `sp` | No | `none` | Policy for subdomains (defaults to `p` value) |

## Complete DNS checklist

Once all records are in place, your domain should have:

| Record | Status | Required? |
|--------|--------|-----------|
| 3x CNAME (DKIM) | Verified | Yes |
| TXT (SPF) | Configured | Strongly recommended |
| TXT (DMARC) | Configured | Strongly recommended |
| CNAME (Tracking domain) | Configured | Optional |

## What's next?

- Set up a custom [Tracking Domain](/domains/tracking-domains) for branded open and click tracking links.
- If your domain is not verifying, see [Domain Verification Troubleshooting](/troubleshooting/domain-verification).
- Learn about organizing verified domains into [Channels](/channels/understanding-channels).