An effective Amazon SES DKIM setup helps receiving mail servers verify that your emails were genuinely sent from your domain and were not modified during transit. This improves email deliverability, builds sender reputation, and reduces the risk of phishing and domain spoofing attacks targeting your brand.
Amazon SES gives you three DKIM options: Easy DKIM, BYODKIM, and manual signing. Most beginners should start with Easy DKIM because AWS handles the cryptographic keys for you. The setup process mainly involves enabling DKIM in the Amazon SES console and adding a few DNS records to your domain provider.
In this beginner-friendly guide, we will walk you through the complete Amazon SES DKIM setup process, explain how Easy DKIM works, and help you avoid common configuration mistakes that can delay verification or affect email delivery.
Amazon SES DKIM Options
When you set up DKIM in Amazon SES, AWS gives you different ways to handle email signing. The main difference between these options is who manages the DKIM keys and how the signing process works.
For most people, the easiest option is Easy DKIM. AWS handles almost everything in the background, which makes the Amazon SES DKIM setup process much simpler for beginners. But if you want more control over your DKIM keys, you can also use BYODKIM.
Here’s a simple comparison:
| Feature | Easy DKIM | BYODKIM | External / Manual Signing |
| DKIM key ownership | Managed by AWS | Managed by you | Managed outside SES |
| DNS records needed | Multiple CNAME records | TXT record with public key | TXT record with public key |
| Signing process | SES signs emails automatically | SES signs using your uploaded private key | Your application or mail server signs emails |
| Key rotation | Automatic | Manual | Fully manual |
| Setup difficulty | Beginner-friendly | Intermediate | Advanced |
| Best suited for | Most Amazon SES users | Enterprises with compliance requirements | Custom mail infrastructures and MTAs |
| Maintenance effort | Low | Moderate | High |
Easy DKIM is the best choice for most beginners because AWS handles the hard part for you, including key generation and rotation. You mainly just need to add the DNS records shown in your SES dashboard.
BYODKIM is better for companies that want full control over their DKIM keys for security or compliance reasons. Manual signing is mostly used in advanced setups where emails are signed before they are sent through Amazon SES.
Setting Up Easy DKIM for Amazon SES
Before starting the Amazon SES DKIM setup process, make sure you have:
- A verified domain identity in Amazon SES
- Access to your domain’s DNS settings
- Permission to manage records at your DNS hosting provider
Step 1: Open Verified Identities in Amazon SES
Log in to your AWS Management Console and open the Amazon SES dashboard.
Then follow these steps:
- Go to Identity Management
- Click Verified Identities
- Select the domain you want to configure
- Open the DKIM section to review the current settings
If your domain is not verified yet, complete domain verification first before enabling DKIM.
Step 2: Select Easy DKIM
Inside the DKIM settings section, choose Easy DKIM as your DKIM method. If you previously configured another DKIM method, review the existing setup carefully before switching to avoid temporary email authentication issues.
Step 3: Choose the DKIM Key Length
Next, Amazon SES will ask you to select a key length. Choose 2048-bit whenever possible because:
- It provides stronger security
- It’s recommended for modern email authentication
- It helps improve long-term protection against spoofing attacks
Amazon SES still supports 1024-bit keys, but they are considered less secure and are generally not recommended anymore.
Step 4: Enable DKIM and Generate CNAME Records
After enabling Easy DKIM, Amazon SES automatically creates three CNAME records for your domain.
These records are used to:
- Publish your DKIM public keys
- Allow Amazon SES to sign outgoing emails automatically
- Support automatic DKIM key rotation
You do not need to manually generate any cryptographic keys yourself when using Easy DKIM.
Step 5: Add the CNAME Records to Your DNS
Copy all three CNAME records exactly as shown in the SES dashboard and add them to your DNS provider.
While adding the records, avoid common mistakes such as:
- Changing the record names
- Adding the domain name twice
- Copying incomplete values
- Using incorrect TTL settings
Even a minor formatting error can prevent DKIM verification from working properly.
Once the records are added, save the changes in your DNS panel.
Step 6: Wait for DKIM Verification
Amazon SES will automatically check your DNS records and verify DKIM once the CNAME records become publicly visible.
Verification time can vary:
- Sometimes, within a few minutes
- Often, within a couple of hours
- Occasionally, up to 72 hours due to DNS propagation and caching
If the verification status stays pending for too long, you can manually check the DNS records using EasyDMARC’s DKIM Lookup tool. It helps confirm whether your DNS records were published correctly and are accessible to receiving mail servers.
Setting Up BYODKIM for Amazon SES
BYODKIM, short for Bring Your Own DKIM, allows you to use your own DKIM keys instead of the ones automatically generated by Amazon SES. It also helps companies use the same DKIM selector and signing key across multiple email service providers like SendGrid or Mailgun.
For most users, Easy DKIM is enough. But BYODKIM is useful when you need centralized control over DKIM keys or when you have compliance requirements for key management.
Step 1: Generate an RSA Key Pair
To use BYODKIM, you first need to create your own RSA public and private key pair. You can generate the keys using OpenSSL.
Generate a 1024-bit or 2048-bit RSA private key using OpenSSL:
openssl genrsa -out DKIM_private.key 2048
Extract the public key:
openssl rsa -in DKIM_private.key -pubout -out DKIM_public.pem
The private key will later be uploaded to Amazon SES, while the public key will be published in your DNS records.
You can also use the EasyDMARC DKIM Record Generator tool if you want a simpler way to generate DKIM keys and properly formatted DNS records without manually working through OpenSSL commands.
Step 2: Prepare the Public Key for DNS
Open the DKIM_public.pem file and clean up the key before adding it to DNS. You need to:
- Remove the BEGIN PUBLIC KEY and END PUBLIC KEY lines
- Remove all line breaks
- Keep only the long Base64-encoded string
Your final DKIM TXT record should look similar to this:
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7x2…
Make sure the full p= value stays on one logical line.
Step 3: Configure BYODKIM in Amazon SES
Unlike Easy DKIM, BYODKIM setup is done using the Amazon SES v2 API or AWS CLI.
You will need to:
- Define a DKIM selector
- Upload your Base64-encoded private key
- Enable signing for the domain identity
Step 4: Publish the TXT Record in DNS
Now add the DKIM TXT record to your DNS provider.
Host:
selector1._domainkey.yourdomain.com
Value:
v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEY
Once the record is published, Amazon SES will start checking the DNS entry automatically.
Step 5: Verify DKIM Status
Go back to the Amazon SES dashboard and check the DKIM status for your domain identity.
The status will initially show as Pending and later change to Successful once Amazon SES detects the TXT record. DNS propagation may take anywhere from a few minutes to several hours.
Final Takeaways on Amazon SES Easy DKIM and BYODKIM
Whether you use Easy DKIM for a quick AWS-managed setup or BYODKIM for more control over your DKIM keys, setting up DKIM properly helps your emails reach inboxes more reliably and protects your domain from spoofing and phishing attacks.
If managing DKIM, SPF, and DMARC records feels confusing or time-consuming, you can try EasyDMARC’s 14-day free trial. Our team helps you find and fix email authentication problems so you can improve email delivery, protect your domain, and stay compliant with modern email sender requirements.
